mirror/clamav
1
0
Fork 0
mirror of https://github.com/Cisco-Talos/clamav.git synced 2026-05-08 07:36:28 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
54903eec99fe13f93e73ce6aed70ec68b0ffc778
clamav/libclamav/c++/ClamBCRTChecks.cpp
Micah Snyder da23b1ceab CMake: Fix support for external LLVM (3.6) 
Have to manually link libtinfo (`-ltinfo`) because our FindLLVM
didn't add it to the LLVM_LIBRARIES variable for us. See:
- https://stackoverflow.com/questions/21477407/llvm-3-5-fails-to-link

Have to remove the CXX_STANDARD setting at the top of CMakeLists.txt
because of c++90 / c++11 ABI compatibility issues w/ LLVM. See:
- https://maleadt.github.io/LLVM.jl/dev/man/troubleshooting/

Rename "llvm/Config/config.h" "llvm/Config/llvm-config.h" because
LLVM renamed it in 2.8.

Have to link LLVM manually with the test binaries that use the
clamav object library instead of libclamav shared library.
CMake does not propagate library dependencies from object files.

I tested on ubuntu:16.04 with LLVM 3.6 built from source using:
```
/usr/local/bin/cmake .. -D CMAKE_INSTALL_PREFIX=/opt/llvm/3.6 \
  -D LLVM_ENABLE_RTTI=ON
```
Then built clamav w/:
```
/usr/local/bin/cmake .. -D CMAKE_INSTALL_PREFIX=`pwd`/install \
  -D BYTECODE_RUNTIME="llvm" \
  -D LLVM_ROOT_DIR="/opt/llvm/3.6" \
  -D LLVM_FIND_VERSION="3.6.0" && make && make install
```
2021-05-19 14:20:59 -07:00

972 lines
37 KiB
C++
Raw Blame History

/*
* Compile LLVM bytecode to ClamAV bytecode.
*
* Copyright (C) 2013-2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
* Copyright (C) 2009-2013 Sourcefire, Inc.
*
* Authors: Török Edvin, Kevin Lin
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
* MA 02110-1301, USA.
*/
#define DEBUG_TYPE "clambc-rtcheck"
#include "ClamBCModule.h"
#include "ClamBCDiagnostics.h"
#include "llvm30_compat.h" /* libclamav-specific */
#include "llvm/ADT/DenseSet.h"
#include "llvm/ADT/PostOrderIterator.h"
#include "llvm/ADT/SCCIterator.h"
#include "llvm/Analysis/CallGraph.h"
#if LLVM_VERSION < 32
#include "llvm/Analysis/DebugInfo.h"
#elif LLVM_VERSION < 35
#include "llvm/DebugInfo.h"
#else
#include "llvm/IR/DebugInfo.h"
#endif
#if LLVM_VERSION < 35
#include "llvm/Analysis/Dominators.h"
#include "llvm/Analysis/Verifier.h"
#else
#include "llvm/IR/Dominators.h"
#include "llvm/IR/Verifier.h"
#endif
#include "llvm/Analysis/ConstantFolding.h"
#if LLVM_VERSION < 29
//#include "llvm/Analysis/LiveValues.h" (unused)
#include "llvm/Analysis/PointerTracking.h"
#else
#include "llvm/Analysis/ValueTracking.h"
#include "PointerTracking.h" /* included from old LLVM source */
#endif
#include "llvm/Analysis/ScalarEvolution.h"
#include "llvm/Analysis/ScalarEvolutionExpressions.h"
#include "llvm/Analysis/ScalarEvolutionExpander.h"
#include "llvm/Config/llvm-config.h"
#include "llvm/Pass.h"
#include "llvm/Support/CommandLine.h"
#if LLVM_VERSION < 35
#include "llvm/Support/DataFlow.h"
#include "llvm/Support/InstIterator.h"
#include "llvm/Support/GetElementPtrTypeIterator.h"
#else
#include "llvm/IR/InstIterator.h"
#include "llvm/IR/GetElementPtrTypeIterator.h"
#endif
#include "llvm/ADT/DepthFirstIterator.h"
#include "llvm/Transforms/Scalar.h"
#include "llvm/Transforms/Utils/BasicBlockUtils.h"
#include "llvm/Support/Debug.h"
#if LLVM_VERSION < 32
#include "llvm/Target/TargetData.h"
#elif LLVM_VERSION < 33
#include "llvm/DataLayout.h"
#else
#include "llvm/IR/DataLayout.h"
#endif
#if LLVM_VERSION < 33
#include "llvm/DerivedTypes.h"
#include "llvm/Instructions.h"
#include "llvm/IntrinsicInst.h"
#include "llvm/Intrinsics.h"
#include "llvm/LLVMContext.h"
#include "llvm/Module.h"
#else
#include "llvm/IR/DerivedTypes.h"
#include "llvm/IR/Instructions.h"
#include "llvm/IR/IntrinsicInst.h"
#include "llvm/IR/Intrinsics.h"
#include "llvm/IR/LLVMContext.h"
#include "llvm/IR/Module.h"
#endif
#if LLVM_VERSION < 33
#include "llvm/Support/InstVisitor.h"
#elif LLVM_VERSION < 35
#include "llvm/InstVisitor.h"
#else
#include "llvm/IR/InstVisitor.h"
#endif
#define DEFINEPASS(passname) passname() : FunctionPass(ID)
using namespace llvm;
#if LLVM_VERSION < 29
/* function is succeeded in later LLVM with LLVM corresponding standalone */
static Value *GetUnderlyingObject(Value *P, TargetData *TD)
{
return P->getUnderlyingObject();
}
#endif
namespace llvm {
class PtrVerifier;
#if LLVM_VERSION >= 29
void initializePtrVerifierPass(PassRegistry&);
#endif
class PtrVerifier : public FunctionPass {
private:
DenseSet<Function*> badFunctions;
std::vector<Instruction*> delInst;
#if LLVM_VERSION < 35
CallGraphNode *rootNode;
#else
CallGraph *CG;
#endif
public:
static char ID;
#if LLVM_VERSION < 35
DEFINEPASS(PtrVerifier), rootNode(0), PT(), TD(), SE(), expander(),
#else
DEFINEPASS(PtrVerifier), CG(0), PT(), TD(), SE(), expander(),
#endif
DT(), AbrtBB(), Changed(false), valid(false), EP() {
#if LLVM_VERSION >= 29
initializePtrVerifierPass(*PassRegistry::getPassRegistry());
#endif
}
virtual bool runOnFunction(Function &F) {
/*
#ifndef CLAMBC_COMPILER
// Bytecode was already verified and had stack protector applied.
// We get called again because ALL bytecode functions loaded are part of
// the same module.
if (F.hasFnAttr(Attribute::StackProtectReq))
return false;
#endif
*/
DEBUG(errs() << "Running on " << F.getName() << "\n");
DEBUG(F.dump());
Changed = false;
BaseMap.clear();
BoundsMap.clear();
delInst.clear();
AbrtBB = 0;
valid = true;
#if LLVM_VERSION < 35
if (!rootNode) {
rootNode = getAnalysis<CallGraph>().getRoot();
#else
if (!CG) {
CG = &getAnalysis<CallGraphWrapperPass>().getCallGraph();
#endif
// No recursive functions for now.
// In the future we may insert runtime checks for stack depth.
#if LLVM_VERSION < 35
for (scc_iterator<CallGraphNode*> SCCI = scc_begin(rootNode),
E = scc_end(rootNode); SCCI != E; ++SCCI) {
#else
for (scc_iterator<CallGraph*> SCCI = scc_begin(CG); !SCCI.isAtEnd(); ++SCCI) {
#endif
const std::vector<CallGraphNode*> &nextSCC = *SCCI;
if (nextSCC.size() > 1 || SCCI.hasLoop()) {
errs() << "INVALID: Recursion detected, callgraph SCC components: ";
for (std::vector<CallGraphNode*>::const_iterator I = nextSCC.begin(),
E = nextSCC.end(); I != E; ++I) {
Function *FF = (*I)->getFunction();
if (FF) {
errs() << FF->getName() << ", ";
badFunctions.insert(FF);
}
}
if (SCCI.hasLoop())
errs() << "(self-loop)";
errs() << "\n";
}
// we could also have recursion via function pointers, but we don't
// allow calls to unknown functions, see runOnFunction() below
}
}
BasicBlock::iterator It = F.getEntryBlock().begin();
while (isa<AllocaInst>(It) || isa<PHINode>(It)) ++It;
EP = &*It;
#if LLVM_VERSION < 32
TD = &getAnalysis<TargetData>();
#elif LLVM_VERSION < 35
TD = &getAnalysis<DataLayout>();
#else
DataLayoutPass *DLP = getAnalysisIfAvailable<DataLayoutPass>();
TD = DLP ? &DLP->getDataLayout() : 0;
#endif
SE = &getAnalysis<ScalarEvolution>();
PT = &getAnalysis<PointerTracking>();
#if LLVM_VERSION < 35
DT = &getAnalysis<DominatorTree>();
#else
DT = &getAnalysis<DominatorTreeWrapperPass>().getDomTree();
#endif
expander = new SCEVExpander(*SE OPT("SCEVexpander"));
std::vector<Instruction*> insns;
BasicBlock *LastBB = 0;
for (inst_iterator I=inst_begin(F),E=inst_end(F); I != E;++I) {
Instruction *II = &*I;
/* only appears in the libclamav version */
if (II->getParent() != LastBB) {
LastBB = II->getParent();
if (DT->getNode(LastBB) == 0)
continue;
}
/* end-block */
if (isa<LoadInst>(II) || isa<StoreInst>(II) || isa<MemIntrinsic>(II))
insns.push_back(II);
else if (CallInst *CI = dyn_cast<CallInst>(II)) {
Value *V = CI->getCalledValue()->stripPointerCasts();
Function *F = dyn_cast<Function>(V);
if (!F) {
printLocation(CI, true);
errs() << "Could not determine call target\n";
valid = 0;
continue;
}
// this statement disable checks on user-defined CallInst
//if (!F->isDeclaration())
//continue;
insns.push_back(CI);
}
}
for (unsigned Idx = 0; Idx < insns.size(); ++Idx) {
Instruction *II = insns[Idx];
DEBUG(dbgs() << "checking " << *II << "\n");
if (LoadInst *LI = dyn_cast<LoadInst>(II)) {
constType *Ty = LI->getType();
valid &= validateAccess(LI->getPointerOperand(),
TD->getTypeAllocSize(Ty), LI);
} else if (StoreInst *SI = dyn_cast<StoreInst>(II)) {
constType *Ty = SI->getOperand(0)->getType();
valid &= validateAccess(SI->getPointerOperand(),
TD->getTypeAllocSize(Ty), SI);
} else if (MemIntrinsic *MI = dyn_cast<MemIntrinsic>(II)) {
valid &= validateAccess(MI->getDest(), MI->getLength(), MI);
if (MemTransferInst *MTI = dyn_cast<MemTransferInst>(MI)) {
valid &= validateAccess(MTI->getSource(), MI->getLength(), MI);
}
} else if (CallInst *CI = dyn_cast<CallInst>(II)) {
Value *V = CI->getCalledValue()->stripPointerCasts();
Function *F = cast<Function>(V);
constFunctionType *FTy = F->getFunctionType();
CallSite CS(CI);
if (F->getName().equals("memcmp") && FTy->getNumParams() == 3) {
valid &= validateAccess(CS.getArgument(0), CS.getArgument(2), CI);
valid &= validateAccess(CS.getArgument(1), CS.getArgument(2), CI);
continue;
}
unsigned i;
#ifdef CLAMBC_COMPILER
i = 0;
#else
i = 1;// skip hidden ctx*
#endif
for (;i<FTy->getNumParams();i++) {
if (isa<PointerType>(FTy->getParamType(i))) {
Value *Ptr = CS.getArgument(i);
if (i+1 >= FTy->getNumParams()) {
printLocation(CI, false);
errs() << "Call to external function with pointer parameter last"
" cannot be analyzed\n";
errs() << *CI << "\n";
valid = 0;
break;
}
Value *Size = CS.getArgument(i+1);
if (!Size->getType()->isIntegerTy()) {
printLocation(CI, false);
errs() << "Pointer argument must be followed by integer argument"
" representing its size\n";
errs() << *CI << "\n";
valid = 0;
break;
}
valid &= validateAccess(Ptr, Size, CI);
}
}
}
}
if (badFunctions.count(&F))
valid = 0;
if (!valid) {
DEBUG(F.dump());
ClamBCModule::stop("Verification found errors!", &F);
// replace function with call to abort
std::vector<constType*>args;
FunctionType* abrtTy = FunctionType::get(Type::getVoidTy(F.getContext()),args,false);
Constant *func_abort = F.getParent()->getOrInsertFunction("abort", abrtTy);
BasicBlock *BB = &F.getEntryBlock();
Instruction *I = &*BB->begin();
Instruction *UI = new UnreachableInst(F.getContext(), I);
CallInst *AbrtC = CallInst::Create(func_abort, "", UI);
AbrtC->setCallingConv(CallingConv::C);
AbrtC->setTailCall(true);
#if LLVM_VERSION < 32
AbrtC->setDoesNotReturn(true);
AbrtC->setDoesNotThrow(true);
#else
AbrtC->setDoesNotReturn();
AbrtC->setDoesNotThrow();
#endif
// remove all instructions from entry
BasicBlock::iterator BBI = I, BBE=BB->end();
while (BBI != BBE) {
if (!BBI->use_empty())
BBI->replaceAllUsesWith(UndefValue::get(BBI->getType()));
BB->getInstList().erase(BBI++);
}
}
// bb#9967 - deleting obsolete termination instructions
for (unsigned i = 0; i < delInst.size(); ++i)
delInst[i]->eraseFromParent();
delete expander;
return Changed;
}
virtual void releaseMemory() {
badFunctions.clear();
}
virtual void getAnalysisUsage(AnalysisUsage &AU) const {
#if LLVM_VERSION < 32
AU.addRequired<TargetData>();
#elif LLVM_VERSION < 35
AU.addRequired<DataLayout>();
#else
AU.addRequired<DataLayoutPass>();
#endif
#if LLVM_VERSION < 35
AU.addRequired<DominatorTree>();
#else
AU.addRequired<DominatorTreeWrapperPass>();
#endif
AU.addRequired<ScalarEvolution>();
AU.addRequired<PointerTracking>();
#if LLVM_VERSION < 35
AU.addRequired<CallGraph>();
#else
AU.addRequired<CallGraphWrapperPass>();
#endif
}
bool isValid() const { return valid; }
private:
PointerTracking *PT;
#if LLVM_VERSION < 32
TargetData *TD;
#elif LLVM_VERSION < 35
DataLayout *TD;
#else
const DataLayout *TD;
#endif
ScalarEvolution *SE;
SCEVExpander *expander;
DominatorTree *DT;
DenseMap<Value*, Value*> BaseMap;
DenseMap<Value*, Value*> BoundsMap;
BasicBlock *AbrtBB;
bool Changed;
bool valid;
Instruction *EP;
Instruction *getInsertPoint(Value *V)
{
BasicBlock::iterator It = EP;
if (Instruction *I = dyn_cast<Instruction>(V)) {
It = I;
++It;
}
return &*It;
}
Value *getPointerBase(Value *Ptr)
{
if (BaseMap.count(Ptr))
return BaseMap[Ptr];
Value *P = Ptr->stripPointerCasts();
if (BaseMap.count(P)) {
return BaseMap[Ptr] = BaseMap[P];
}
Value *P2 = GetUnderlyingObject(P, TD);
if (P2 != P) {
Value *V = getPointerBase(P2);
return BaseMap[Ptr] = V;
}
constType *P8Ty =
PointerType::getUnqual(Type::getInt8Ty(Ptr->getContext()));
if (PHINode *PN = dyn_cast<PHINode>(Ptr)) {
BasicBlock::iterator It = PN;
++It;
PHINode *newPN = PHINode::Create(P8Ty, HINT(PN->getNumIncomingValues()) ".verif.base", &*It);
Changed = true;
BaseMap[Ptr] = newPN;
for (unsigned i=0;i<PN->getNumIncomingValues();i++) {
Value *Inc = PN->getIncomingValue(i);
Value *V = getPointerBase(Inc);
newPN->addIncoming(V, PN->getIncomingBlock(i));
}
return newPN;
}
if (SelectInst *SI = dyn_cast<SelectInst>(Ptr)) {
BasicBlock::iterator It = SI;
++It;
Value *TrueB = getPointerBase(SI->getTrueValue());
Value *FalseB = getPointerBase(SI->getFalseValue());
if (TrueB && FalseB) {
SelectInst *NewSI = SelectInst::Create(SI->getCondition(), TrueB,
FalseB, ".select.base", &*It);
Changed = true;
return BaseMap[Ptr] = NewSI;
}
}
if (Ptr->getType() != P8Ty) {
if (Constant *C = dyn_cast<Constant>(Ptr))
Ptr = ConstantExpr::getPointerCast(C, P8Ty);
else {
Instruction *I = getInsertPoint(Ptr);
Ptr = new BitCastInst(Ptr, P8Ty, "", I);
}
}
return BaseMap[Ptr] = Ptr;
}
Value* getValAtIdx(Function *F, unsigned Idx) {
Value *Val= NULL;
// check if accessed Idx is within function parameter list
if (Idx < F->arg_size()) {
Function::arg_iterator It = F->arg_begin();
Function::arg_iterator ItEnd = F->arg_end();
for (unsigned i = 0; i < Idx; ++i, ++It) {
// redundant check, should not be possible
if (It == ItEnd) {
// Houston, the impossible has become possible
//printDiagnostic("Idx is outside of Function parameters", F);
errs() << "Idx is outside of Function parameters\n";
errs() << *F << "\n";
//valid = 0;
break;
}
}
// retrieve value ptr of argument of F at Idx
Val = &(*It);
}
else {
// Idx is outside function parameter list
//printDiagnostic("Idx is outside of Function parameters", F);
errs() << "Idx is outside of Function parameters\n";
errs() << *F << "\n";
//valid = 0;
}
return Val;
}
Value* getPointerBounds(Value *Base) {
if (BoundsMap.count(Base))
return BoundsMap[Base];
constType *I64Ty =
Type::getInt64Ty(Base->getContext());
#ifndef CLAMBC_COMPILER
// first arg is hidden ctx
if (Argument *A = dyn_cast<Argument>(Base)) {
if (A->getArgNo() == 0) {
constType *Ty = cast<PointerType>(A->getType())->getElementType();
return ConstantInt::get(I64Ty, TD->getTypeAllocSize(Ty));
} else if (Base->getType()->isPointerTy()) {
Function *F = A->getParent();
const FunctionType *FT = F->getFunctionType();
bool checks = true;
// last argument check
if (A->getArgNo() == (FT->getNumParams()-1)) {
//printDiagnostic("pointer argument cannot be last argument", F);
errs() << "pointer argument cannot be last argument\n";
errs() << *F << "\n";
checks = false;
}
// argument after pointer MUST be a integer (unsigned probably too)
if (checks && !FT->getParamType(A->getArgNo()+1)->isIntegerTy()) {
//printDiagnostic("argument following pointer argument is not an integer", F);
errs() << "argument following pointer argument is not an integer\n";
errs() << *F << "\n";
checks = false;
}
if (checks)
return BoundsMap[Base] = getValAtIdx(F, A->getArgNo()+1);
}
}
if (LoadInst *LI = dyn_cast<LoadInst>(Base)) {
Value *V = GetUnderlyingObject(LI->getPointerOperand()->stripPointerCasts(), TD);
if (Argument *A = dyn_cast<Argument>(V)) {
if (A->getArgNo() == 0) {
// pointers from hidden ctx are trusted to be at least the
// size they say they are
constType *Ty = cast<PointerType>(LI->getType())->getElementType();
return ConstantInt::get(I64Ty, TD->getTypeAllocSize(Ty));
}
}
}
#else
if (Base->getType()->isPointerTy()) {
if (Argument *A = dyn_cast<Argument>(Base)) {
Function *F = A->getParent();
const FunctionType *FT = F->getFunctionType();
bool checks = true;
// last argument check
if (A->getArgNo() == (FT->getNumParams()-1)) {
//printDiagnostic("pointer argument cannot be last argument", F);
errs() << "pointer argument cannot be last argument\n";
errs() << *F << "\n";
checks = false;
}
// argument after pointer MUST be a integer (unsigned probably too)
if (checks && !FT->getParamType(A->getArgNo()+1)->isIntegerTy()) {
//printDiagnostic("argument following pointer argument is not an integer", F);
errs() << "argument following pointer argument is not an integer\n";
errs() << *F << "\n";
checks = false;
}
if (checks)
return BoundsMap[Base] = getValAtIdx(F, A->getArgNo()+1);
}
}
#endif
if (PHINode *PN = dyn_cast<PHINode>(Base)) {
BasicBlock::iterator It = PN;
++It;
PHINode *newPN = PHINode::Create(I64Ty, HINT(PN->getNumIncomingValues()) ".verif.bounds", &*It);
Changed = true;
BoundsMap[Base] = newPN;
bool good = true;
for (unsigned i=0;i<PN->getNumIncomingValues();i++) {
Value *Inc = PN->getIncomingValue(i);
Value *B = getPointerBounds(Inc);
if (!B) {
good = false;
B = ConstantInt::get(newPN->getType(), 0);
DEBUG(dbgs() << "bounds not found while solving phi node: " << *Inc
<< "\n");
}
newPN->addIncoming(B, PN->getIncomingBlock(i));
}
if (!good)
newPN = 0;
return BoundsMap[Base] = newPN;
}
if (SelectInst *SI = dyn_cast<SelectInst>(Base)) {
BasicBlock::iterator It = SI;
++It;
Value *TrueB = getPointerBounds(SI->getTrueValue());
Value *FalseB = getPointerBounds(SI->getFalseValue());
if (TrueB && FalseB) {
SelectInst *NewSI = SelectInst::Create(SI->getCondition(), TrueB,
FalseB, ".select.bounds", &*It);
Changed = true;
return BoundsMap[Base] = NewSI;
}
}
constType *Ty;
Value *V = PT->computeAllocationCountValue(Base, Ty);
if (!V) {
Base = Base->stripPointerCasts();
if (CallInst *CI = dyn_cast<CallInst>(Base)) {
Function *F = CI->getCalledFunction();
constFunctionType *FTy = F->getFunctionType();
// last operand is always size for this API call kind
if (F->isDeclaration() && FTy->getNumParams() > 0) {
CallSite CS(CI);
if (FTy->getParamType(FTy->getNumParams()-1)->isIntegerTy())
V = CS.getArgument(FTy->getNumParams()-1);
}
}
if (!V)
return BoundsMap[Base] = 0;
} else {
unsigned size = TD->getTypeAllocSize(Ty);
if (size > 1) {
Constant *C = cast<Constant>(V);
C = ConstantExpr::getMul(C,
ConstantInt::get(Type::getInt32Ty(C->getContext()),
size));
V = C;
}
}
if (V->getType() != I64Ty) {
if (Constant *C = dyn_cast<Constant>(V))
V = ConstantExpr::getZExt(C, I64Ty);
else {
Instruction *I = getInsertPoint(V);
V = new ZExtInst(V, I64Ty, "", I);
}
}
return BoundsMap[Base] = V;
}
MDNode *getLocation(Instruction *I, bool &Approximate, unsigned MDDbgKind)
{
Approximate = false;
if (MDNode *Dbg = I->getMetadata(MDDbgKind))
return Dbg;
if (!MDDbgKind)
return 0;
Approximate = true;
BasicBlock::iterator It = I;
while (It != I->getParent()->begin()) {
--It;
if (MDNode *Dbg = It->getMetadata(MDDbgKind))
return Dbg;
}
BasicBlock *BB = I->getParent();
while ((BB = BB->getUniquePredecessor())) {
It = BB->end();
while (It != BB->begin()) {
--It;
if (MDNode *Dbg = It->getMetadata(MDDbgKind))
return Dbg;
}
}
return 0;
}
bool insertCheck(const SCEV *Idx, const SCEV *Limit, Instruction *I,
bool strict)
{
if (isa<SCEVCouldNotCompute>(Idx) && isa<SCEVCouldNotCompute>(Limit)) {
errs() << "Could not compute the index and the limit!: \n" << *I << "\n";
return false;
}
if (isa<SCEVCouldNotCompute>(Idx)) {
errs() << "Could not compute index: \n" << *I << "\n";
return false;
}
if (isa<SCEVCouldNotCompute>(Limit)) {
errs() << "Could not compute limit: " << *I << "\n";
return false;
}
BasicBlock *BB = I->getParent();
BasicBlock::iterator It = I;
BasicBlock *newBB = SplitBlock(BB, &*It, this);
PHINode *PN;
unsigned MDDbgKind = I->getContext().getMDKindID("dbg");
//verifyFunction(*BB->getParent());
if (!AbrtBB) {
std::vector<constType*>args;
FunctionType* abrtTy = FunctionType::get(Type::getVoidTy(BB->getContext()),args,false);
args.push_back(Type::getInt32Ty(BB->getContext()));
FunctionType* rterrTy = FunctionType::get(Type::getInt32Ty(BB->getContext()),args,false);
Constant *func_abort = BB->getParent()->getParent()->getOrInsertFunction("abort", abrtTy);
Constant *func_rterr = BB->getParent()->getParent()->getOrInsertFunction("bytecode_rt_error",
rterrTy);
AbrtBB = BasicBlock::Create(BB->getContext(), "rterr.trig", BB->getParent());
PN = PHINode::Create(Type::getInt32Ty(BB->getContext()),HINT(1) "",
AbrtBB);
if (MDDbgKind) {
CallInst *RtErrCall = CallInst::Create(func_rterr, PN, "", AbrtBB);
RtErrCall->setCallingConv(CallingConv::C);
RtErrCall->setTailCall(true);
#if LLVM_VERSION < 32
RtErrCall->setDoesNotThrow(true);
#else
RtErrCall->setDoesNotThrow();
#endif
}
CallInst* AbrtC = CallInst::Create(func_abort, "", AbrtBB);
AbrtC->setCallingConv(CallingConv::C);
AbrtC->setTailCall(true);
#if LLVM_VERSION < 32
AbrtC->setDoesNotReturn(true);
AbrtC->setDoesNotThrow(true);
#else
AbrtC->setDoesNotReturn();
AbrtC->setDoesNotThrow();
#endif
new UnreachableInst(BB->getContext(), AbrtBB);
DT->addNewBlock(AbrtBB, BB);
//verifyFunction(*BB->getParent());
} else {
PN = cast<PHINode>(AbrtBB->begin());
}
unsigned locationid = 0;
bool Approximate;
if (MDNode *Dbg = getLocation(I, Approximate, MDDbgKind)) {
DILocation Loc(Dbg);
locationid = Loc.getLineNumber() << 8;
unsigned col = Loc.getColumnNumber();
if (col > 254)
col = 254;
if (Approximate)
col = 255;
locationid |= col;
}
PN->addIncoming(ConstantInt::get(Type::getInt32Ty(BB->getContext()),
locationid), BB);
TerminatorInst *TI = BB->getTerminator();
Value *IdxV = expander->expandCodeFor(Idx, Limit->getType(), TI);
Value *LimitV = expander->expandCodeFor(Limit, Limit->getType(), TI);
if (isa<Instruction>(IdxV) &&
!DT->dominates(cast<Instruction>(IdxV)->getParent(),I->getParent())) {
printLocation(I, true);
errs() << "basic block with value [ " << IdxV->getName();
errs() << " ] with limit [ " << LimitV->getName();
errs() << " ] does not dominate" << *I << "\n";
return false;
}
if (isa<Instruction>(LimitV) &&
!DT->dominates(cast<Instruction>(LimitV)->getParent(),I->getParent())) {
printLocation(I, true);
errs() << "basic block with limit [" << LimitV->getName();
errs() << " ] on value [ " << IdxV->getName();
errs() << " ] does not dominate" << *I << "\n";
return false;
}
Value *Cond = new ICmpInst(TI, strict ?
ICmpInst::ICMP_ULT :
ICmpInst::ICMP_ULE, IdxV, LimitV);
BranchInst::Create(newBB, AbrtBB, Cond, TI);
//TI->eraseFromParent();
delInst.push_back(TI);
// Update dominator info
BasicBlock *DomBB =
DT->findNearestCommonDominator(BB, DT->getNode(AbrtBB)->getIDom()->getBlock());
DT->changeImmediateDominator(AbrtBB, DomBB);
return true;
}
static void MakeCompatible(ScalarEvolution *SE, const SCEV*& LHS, const SCEV*& RHS)
{
if (const SCEVZeroExtendExpr *ZL = dyn_cast<SCEVZeroExtendExpr>(LHS))
LHS = ZL->getOperand();
if (const SCEVZeroExtendExpr *ZR = dyn_cast<SCEVZeroExtendExpr>(RHS))
RHS = ZR->getOperand();
constType* LTy = SE->getEffectiveSCEVType(LHS->getType());
constType *RTy = SE->getEffectiveSCEVType(RHS->getType());
if (SE->getTypeSizeInBits(RTy) > SE->getTypeSizeInBits(LTy))
LTy = RTy;
LHS = SE->getNoopOrZeroExtend(LHS, LTy);
RHS = SE->getNoopOrZeroExtend(RHS, LTy);
}
bool checkCond(Instruction *ICI, Instruction *I, bool equal)
{
#if LLVM_VERSION < 35
for (Value::use_iterator JU=ICI->use_begin(),JUE=ICI->use_end();
JU != JUE; ++JU) {
#else
for (Value::user_iterator JU=ICI->user_begin(),JUE=ICI->user_end();
JU != JUE; ++JU) {
#endif
Value *JU_V = *JU;
if (BranchInst *BI = dyn_cast<BranchInst>(JU_V)) {
if (!BI->isConditional())
continue;
BasicBlock *S = BI->getSuccessor(equal);
if (DT->dominates(S, I->getParent()))
return true;
}
if (BinaryOperator *BI = dyn_cast<BinaryOperator>(JU_V)) {
if (BI->getOpcode() == Instruction::Or &&
checkCond(BI, I, equal))
return true;
if (BI->getOpcode() == Instruction::And &&
checkCond(BI, I, !equal))
return true;
}
}
return false;
}
bool checkCondition(Instruction *CI, Instruction *I)
{
#if LLVM_VERSION < 35
for (Value::use_iterator U=CI->use_begin(),UE=CI->use_end();
U != UE; ++U) {
#else
for (Value::user_iterator U=CI->user_begin(),UE=CI->user_end();
U != UE; ++U) {
#endif
Value *U_V = *U;
if (ICmpInst *ICI = dyn_cast<ICmpInst>(U_V)) {
if (ICI->getOperand(0)->stripPointerCasts() == CI &&
isa<ConstantPointerNull>(ICI->getOperand(1))) {
if (checkCond(ICI, I, ICI->getPredicate() == ICmpInst::ICMP_EQ))
return true;
}
}
}
return false;
}
bool validateAccess(Value *Pointer, Value *Length, Instruction *I)
{
// get base
Value *Base = getPointerBase(Pointer);
Value *SBase = Base->stripPointerCasts();
// get bounds
Value *Bounds = getPointerBounds(SBase);
if (!Bounds) {
printLocation(I, true);
errs() << "no bounds for base ";
printValue(SBase);
errs() << " while checking access to ";
printValue(Pointer);
errs() << " of length ";
printValue(Length);
errs() << "\n";
return false;
}
// checks if a NULL pointer check (returned from function) is made:
if (CallInst *CI = dyn_cast<CallInst>(Base->stripPointerCasts())) {
// by checking if use is in the same block (i.e. no branching decisions)
if (I->getParent() == CI->getParent()) {
printLocation(I, true);
errs() << "no null pointer check of pointer ";
printValue(Base, false, true);
errs() << " obtained by function call";
errs() << " before use in same block\n";
return false;
}
// by checking if a conditional contains the values in question somewhere
// between their usage
if (!checkCondition(CI, I)) {
printLocation(I, true);
errs() << "no null pointer check of pointer ";
printValue(Base, false, true);
errs() << " obtained by function call";
errs() << " before use\n";
return false;
}
}
constType *I64Ty =
Type::getInt64Ty(Base->getContext());
const SCEV *SLen = SE->getSCEV(Length);
const SCEV *OffsetP = SE->getMinusSCEV(SE->getSCEV(Pointer),
SE->getSCEV(Base));
SLen = SE->getNoopOrZeroExtend(SLen, I64Ty);
OffsetP = SE->getNoopOrZeroExtend(OffsetP, I64Ty);
const SCEV *Limit = SE->getSCEV(Bounds);
Limit = SE->getNoopOrZeroExtend(Limit, I64Ty);
DEBUG(dbgs() << "Checking access to " << *Pointer << " of length " <<
*Length << "\n");
if (OffsetP == Limit) {
printLocation(I, true);
errs() << "OffsetP == Limit: " << *OffsetP << "\n";
errs() << " while checking access to ";
printValue(Pointer);
errs() << " of length ";
printValue(Length);
errs() << "\n";
return false;
}
if (SLen == Limit) {
if (const SCEVConstant *SC = dyn_cast<SCEVConstant>(OffsetP)) {
if (SC->isZero())
return true;
}
errs() << "SLen == Limit: " << *SLen << "\n";
errs() << " while checking access to " << *Pointer << " of length "
<< *Length << " at " << *I << "\n";
return false;
}
bool valid = true;
SLen = SE->getAddExpr(OffsetP, SLen);
// check that offset + slen <= limit;
// umax(offset+slen, limit) == limit is a sufficient (but not necessary
// condition)
const SCEV *MaxL = SE->getUMaxExpr(SLen, Limit);
if (MaxL != Limit) {
DEBUG(dbgs() << "MaxL != Limit: " << *MaxL << ", " << *Limit << "\n");
valid &= insertCheck(SLen, Limit, I, false);
}
//TODO: nullpointer check
const SCEV *Max = SE->getUMaxExpr(OffsetP, Limit);
if (Max == Limit)
return valid;
DEBUG(dbgs() << "Max != Limit: " << *Max << ", " << *Limit << "\n");
// check that offset < limit
valid &= insertCheck(OffsetP, Limit, I, true);
return valid;
}
bool validateAccess(Value *Pointer, unsigned size, Instruction *I)
{
return validateAccess(Pointer,
ConstantInt::get(Type::getInt32Ty(Pointer->getContext()),
size), I);
}
};
char PtrVerifier::ID;
} /* end namespace llvm */
#if LLVM_VERSION >= 29
INITIALIZE_PASS_BEGIN(PtrVerifier, "", "", false, false)
#if LLVM_VERSION < 32
INITIALIZE_PASS_DEPENDENCY(TargetData)
#elif LLVM_VERSION < 35
INITIALIZE_PASS_DEPENDENCY(DataLayout)
#else
INITIALIZE_PASS_DEPENDENCY(DataLayoutPass)
#endif
#if LLVM_VERSION < 35
INITIALIZE_PASS_DEPENDENCY(DominatorTree)
#else
INITIALIZE_PASS_DEPENDENCY(DominatorTreeWrapperPass)
#endif
INITIALIZE_PASS_DEPENDENCY(ScalarEvolution)
#if LLVM_VERSION < 34
INITIALIZE_AG_DEPENDENCY(CallGraph)
#elif LLVM_VERSION < 35
INITIALIZE_PASS_DEPENDENCY(CallGraph)
#else
INITIALIZE_PASS_DEPENDENCY(CallGraphWrapperPass)
#endif
INITIALIZE_PASS_DEPENDENCY(PointerTracking)
INITIALIZE_PASS_END(PtrVerifier, "clambc-rtchecks", "ClamBC RTchecks", false, false)
#endif
llvm::Pass *createClamBCRTChecks()
{
return new PtrVerifier();
}
Reference in New Issue View Git Blame Copy Permalink