#include "checkmemoryleak.h"

#include "astutils.h"

#include "library.h"

#include "mathlib.h"

#include "settings.h"

#include "standards.h"

#include "symboldatabase.h"

#include "token.h"

#include "tokenize.h"

#include "tokenlist.h"

#include "utils.h"

#include "valueflow.h"

#include <algorithm>

#include <cstddef>

#include <set>

#include <stack>

namespace {

CheckMemoryLeakInFunction instance1;

CheckMemoryLeakInClass instance2;

CheckMemoryLeakStructMember instance3;

CheckMemoryLeakNoVar instance4;

}

static const CWE CWE398(398U); // Indicator of Poor Code Quality

static const CWE CWE401(401U); // Improper Release of Memory Before Removing Last Reference ('Memory Leak')

static const CWE CWE771(771U); // Missing Reference to Active Allocated Resource

static const CWE CWE772(772U); // Missing Release of Resource after Effective Lifetime

static unsigned int countParameters(const Token *tok)

}

static const std::set<std::string> call_func_white_list = {

"_open", "_wopen", "access", "adjtime", "asctime_r", "asprintf", "chdir", "chmod", "chown"

, "creat", "ctime_r", "execl", "execle", "execlp", "execv", "execve", "fchmod", "fcntl"

, "fdatasync", "fclose", "flock", "fmemopen", "fnmatch", "fopen", "fopencookie", "for", "free"

, "freopen", "fseeko", "fstat", "fsync", "ftello", "ftruncate", "getgrnam", "gethostbyaddr", "gethostbyname"

, "getnetbyname", "getopt", "getopt_long", "getprotobyname", "getpwnam", "getservbyname", "getservbyport"

, "glob", "gmtime", "gmtime_r", "if", "index", "inet_addr", "inet_aton", "inet_network", "initgroups"

, "ioctl", "link", "localtime_r", "lockf", "lseek", "lstat", "mkdir", "mkfifo", "mknod", "mkstemp"

, "obstack_printf", "obstack_vprintf", "open", "opendir", "parse_printf_format", "pathconf"

, "perror", "popen", "posix_fadvise", "posix_fallocate", "pread", "psignal", "pwrite", "read", "readahead"

, "readdir", "readdir_r", "readlink", "readv", "realloc", "regcomp", "return", "rewinddir", "rindex"

, "rmdir", "scandir", "seekdir", "setbuffer", "sethostname", "setlinebuf", "sizeof", "strdup"

, "stat", "stpcpy", "strcasecmp", "stricmp", "strncasecmp", "switch"

, "symlink", "sync_file_range", "telldir", "tempnam", "time", "typeid", "unlink"

, "utime", "utimes", "vasprintf", "while", "wordexp", "write", "writev"

};

bool CheckMemoryLeak::isclass(const Token *tok, unsigned int varid) const

}

CheckMemoryLeak::AllocType CheckMemoryLeak::getAllocationType(const Token *tok2, unsigned int varid, std::list<const Function*> *callstack) const

}

CheckMemoryLeak::AllocType CheckMemoryLeak::getReallocationType(const Token *tok2, unsigned int varid)

}

CheckMemoryLeak::AllocType CheckMemoryLeak::getDeallocationType(const Token *tok, unsigned int varid) const

}

void CheckMemoryLeak::memoryLeak(const Token *tok, const std::string &varname, AllocType alloctype) const

}

void CheckMemoryLeak::reportErr(const Token *tok, Severity::SeverityType severity, const std::string &id, const std::string &msg, const CWE &cwe) const

}

void CheckMemoryLeak::reportErr(const std::list<const Token *> &callstack, Severity::SeverityType severity, const std::string &id, const std::string &msg, const CWE &cwe) const

}

void CheckMemoryLeak::memleakError(const Token *tok, const std::string &varname) const

{

reportErr(tok, Severity::error, "memleak", "$symbol:" + varname + "\nMemory leak: $symbol", CWE(401U));

}

void CheckMemoryLeak::memleakUponReallocFailureError(const Token *tok, const std::string &varname) const

{

reportErr(tok, Severity::error, "memleakOnRealloc", "$symbol:" + varname + "\nCommon realloc mistake: \'$symbol\' nulled but not freed upon failure", CWE(401U));

}

void CheckMemoryLeak::resourceLeakError(const Token *tok, const std::string &varname) const

}

void CheckMemoryLeak::deallocDeallocError(const Token *tok, const std::string &varname) const

{

reportErr(tok, Severity::error, "deallocDealloc", "$symbol:" + varname + "\nDeallocating a deallocated pointer: $symbol", CWE(415U));

}

void CheckMemoryLeak::deallocuseError(const Token *tok, const std::string &varname) const

{

reportErr(tok, Severity::error, "deallocuse", "$symbol:" + varname + "\nDereferencing '$symbol' after it is deallocated / released", CWE(416U));

}

void CheckMemoryLeak::mismatchSizeError(const Token *tok, const std::string &sz) const

{

reportErr(tok, Severity::error, "mismatchSize", "The allocated size " + sz + " is not a multiple of the underlying type's size.", CWE(131U));

}

void CheckMemoryLeak::mismatchAllocDealloc(const std::list<const Token *> &callstack, const std::string &varname) const

{

reportErr(callstack, Severity::error, "mismatchAllocDealloc", "$symbol:" + varname + "\nMismatching allocation and deallocation: $symbol", CWE(762U));

}

CheckMemoryLeak::AllocType CheckMemoryLeak::functionReturnType(const Function* func, std::list<const Function*> *callstack) const

}

const char *CheckMemoryLeak::functionArgAlloc(const Function *func, unsigned int targetpar, AllocType &allocType) const

{

allocType = No;

if (!func || !func->functionScope)

return "";

if (!Token::simpleMatch(func->retDef, "void"))

return "";

std::list<Variable>::const_iterator arg = func->argumentList.begin();

for (; arg != func->argumentList.end(); ++arg) {

if (arg->index() == targetpar-1)

break;

}

if (arg == func->argumentList.end())

return "";

// Is **

if (!arg->isPointer())

return "";

const Token* tok = arg->typeEndToken();

tok = tok->previous();

if (tok->str() != "*")

return "";

// Check if pointer is allocated.

bool realloc = false;

for (tok = func->functionScope->bodyStart; tok && tok != func->functionScope->bodyEnd; tok = tok->next()) {

if (tok->varId() == arg->declarationId()) {

if (Token::Match(tok->tokAt(-3), "free ( * %name% )")) {

realloc = true;

allocType = No;

} else if (Token::Match(tok->previous(), "* %name% =")) {

allocType = getAllocationType(tok->tokAt(2), arg->declarationId());

if (allocType == No) {

allocType = getReallocationType(tok->tokAt(2), arg->declarationId());

}

if (allocType != No) {

if (realloc)

return "realloc";

return "alloc";

}

} else {

// unhandled variable usage: bailout

return "";

}

}

}

return "";

}

static bool notvar(const Token *tok, unsigned int varid)

}

static bool ifvar(const Token *tok, unsigned int varid, const std::string &comp, const std::string &rhs)

}

static bool alwaysTrue(const Token *tok)

}

bool CheckMemoryLeakInFunction::test_white_list(const std::string &funcname, const Settings *settings, bool cpp)

{

return ((call_func_white_list.find(funcname)!=call_func_white_list.end()) || settings->library.isLeakIgnore(funcname) || (cpp && funcname == "delete"));

}

namespace {

const std::set<std::string> call_func_keywords = {

"asprintf"

, "delete"

, "fclose"

, "for"

, "free"

, "if"

, "realloc"

, "return"

, "switch"

, "while"

, "sizeof"

};

}

const char * CheckMemoryLeakInFunction::call_func(const Token *tok, std::list<const Token *> callstack, const unsigned int varid, AllocType &alloctype, AllocType &dealloctype, bool &allocpar, unsigned int sz)

{

if (test_white_list(tok->str(), mSettings, mTokenizer->isCPP())) {

if (call_func_keywords.find(tok->str())!=call_func_keywords.end())

return nullptr;

// is the varid a parameter?

for (const Token *tok2 = tok->tokAt(2); tok2 && tok2 != tok->linkAt(1); tok2 = tok2->next()) {

if (tok2->str() == "(") {

tok2 = tok2->nextArgument();

if (!tok2)

break;

}

if (tok2->varId() == varid) {

if (tok->strAt(-1) == ".")

return "use";

else if (tok2->strAt(1) == "=")

return "assign";

else if (tok->str()=="printf")

return "use"; // <- it is not certain printf dereference the pointer TODO: check the format string

else

return "use_";

}

}

return nullptr;

}

if (mSettings->library.isnoreturn(tok) && tok->strAt(-1) != "=")

return "exit";

if (varid > 0 && (getReallocationType(tok, varid) != No || getDeallocationType(tok, varid) != No))

return nullptr;

if (callstack.size() > 2)

return "dealloc_";

const std::string& funcname(tok->str());

for (const Token *tok2 : callstack) {

if (tok2 && tok2->str() == funcname)

return "recursive";

}

callstack.push_back(tok);

// lock/unlock..

if (varid == 0) {

const Function* func = tok->function();

if (!func || !func->hasBody())

return nullptr;

Token *ftok = getcode(func->functionScope->bodyStart->next(), callstack, 0, alloctype, dealloctype, false, 1);

simplifycode(ftok);

const char *ret = nullptr;

if (Token::simpleMatch(ftok, "; alloc ; }"))

ret = "alloc";

else if (Token::simpleMatch(ftok, "; dealloc ; }"))

ret = "dealloc";

TokenList::deleteTokens(ftok);

return ret;

}

// how many parameters is there in the function call?

const unsigned int numpar = countParameters(tok);

if (numpar == 0) {

// Taking return value => it is not a noreturn function

if (tok->strAt(-1) == "=")

return nullptr;

// Function is not noreturn

if (tok->function() && tok->function()->functionScope) {

std::string temp;

if (!mSettings->library.isScopeNoReturn(tok->function()->functionScope->bodyEnd, &temp) && temp.empty())

return nullptr;

} else if (mSettings->library.isnotnoreturn(tok))

return nullptr;

return "callfunc";

}

unsigned int par = 0;

const bool dot(tok->previous()->str() == ".");

const bool eq(tok->previous()->str() == "=");

const Token *functok = tok;

tok = Token::findsimplematch(tok, "(");

if (tok)

tok = tok->next();

for (; tok; tok = tok->nextArgument()) {

++par;

if (Token::Match(tok, "%varid% [,()]", varid)) {

if (dot)

return "use";

const Function* function = functok->function();

if (!function)

return "use";

// how many parameters does the function want?

if (numpar != function->argCount()) // TODO: Handle default parameters

return "recursive";

if (!function->functionScope)

return "use";

const Variable* param = function->getArgumentVar(par-1);

if (!param || !param->nameToken())

return "use";

Token *func = getcode(function->functionScope->bodyStart->next(), callstack, param->declarationId(), alloctype, dealloctype, false, sz);

//simplifycode(func);

const Token *func_ = func;

while (func_ && func_->str() == ";")

func_ = func_->next();

const char *ret = nullptr;

/** @todo handle "goto" */

if (Token::findsimplematch(func_, "dealloc"))

ret = "dealloc";

else if (Token::findsimplematch(func_, "use"))

ret = "use";

else if (Token::findsimplematch(func_, "&use"))

ret = "&use";

TokenList::deleteTokens(func);

return ret;

}

if (Token::Match(tok, "& %varid% [,()]", varid)) {

const Function *func = functok->function();

if (func == nullptr)

continue;

AllocType a;

const char *ret = functionArgAlloc(func, par, a);

if (a != No) {

if (alloctype == No)

alloctype = a;

else if (alloctype != a)

alloctype = Many;

allocpar = true;

return ret;

}

}

if (Token::Match(tok, "%varid% . %name% [,)]", varid))

return "use";

}

return (eq || mSettings->experimental) ? nullptr : "callfunc";

}

template<typename T>

static void addtoken(Token **rettail, const Token *tok, T&& str)

}

Token *CheckMemoryLeakInFunction::getcode(const Token *tok, std::list<const Token *> callstack, const unsigned int varid, CheckMemoryLeak::AllocType &alloctype, CheckMemoryLeak::AllocType &dealloctype, bool classmember, unsigned int sz)

{

// variables whose value depends on if(!var). If one of these variables

// is used in a if-condition then generate "ifv" instead of "if".

std::set<unsigned int> extravar;

// The first token should be ";"

Token* rethead = new Token();

rethead->str(";");

rethead->linenr(tok->linenr());

rethead->fileIndex(tok->fileIndex());

Token* rettail = rethead;

int indentlevel = 0;

int parlevel = 0;

for (; tok; tok = tok->next()) {

if (tok->str() == "{") {

addtoken(&rettail, tok, "{");

++indentlevel;

} else if (tok->str() == "}") {

addtoken(&rettail, tok, "}");

if (indentlevel <= 0)

break;

--indentlevel;

}

else if (tok->str() == "(")

++parlevel;

else if (tok->str() == ")")

--parlevel;

if (parlevel == 0 && tok->str() == ";")

addtoken(&rettail, tok, ";");

// Start of new statement.. check if the statement has anything interesting

if (varid > 0 && parlevel == 0 && Token::Match(tok, "[;{}]")) {

if (Token::Match(tok->next(), "[{};]"))

continue;

// function calls are interesting..

const Token *tok2 = tok;

if (Token::Match(tok2, "[{};] :: %name%"))

tok2 = tok2->next();

while (Token::Match(tok2->next(), "%name% ::|. %name%"))

tok2 = tok2->tokAt(2);

if (Token::Match(tok2->next(), "%name% ("))

;

else if (Token::Match(tok->next(), "continue|break|return|throw|goto|do|else"))

;

else {

const Token *skipToToken = nullptr;

// scan statement for interesting keywords / varid

for (tok2 = tok->next(); tok2; tok2 = tok2->next()) {

if (tok2->str() == ";") {

// nothing interesting found => skip this statement

skipToToken = tok2->previous();

break;

}

if (tok2->varId() == varid ||

tok2->str() == ":" || tok2->str() == "{" || tok2->str() == "}") {

break;

}

}

if (skipToToken) {

tok = skipToToken;

continue;

}

}

}

if (varid == 0) {

if (!callstack.empty() && Token::Match(tok, "[;{}] __cppcheck_lock|__cppcheck_unlock ( ) ;")) {

// Type of leak = Resource leak

alloctype = dealloctype = CheckMemoryLeak::File;

if (tok->next()->str() == "__cppcheck_lock") {

addtoken(&rettail, tok, "alloc");

} else {

addtoken(&rettail, tok, "dealloc");

}

tok = tok->tokAt(3);

continue;

}

if (Token::simpleMatch(tok, "if (")) {

addtoken(&rettail, tok, "if");

tok = tok->next()->link();

continue;

}

} else {

if (Token::Match(tok, "%varid% = close ( %varid% )", varid)) {

addtoken(&rettail, tok, "dealloc");

addtoken(&rettail, tok, ";");

addtoken(&rettail, tok, "assign");

addtoken(&rettail, tok, ";");

tok = tok->tokAt(5);

continue;

}

// var = strcpy|.. ( var ,

if (Token::Match(tok, "[;{}] %varid% = memcpy|memmove|memset|strcpy|strncpy|strcat|strncat ( %varid% ,", varid)) {

tok = tok->linkAt(4);

continue;

}

if (Token::Match(tok->previous(), "[(;{}] %varid% =", varid) ||

Token::Match(tok, "asprintf|vasprintf ( & %varid% ,", varid)) {

CheckMemoryLeak::AllocType alloc;

if (Token::Match(tok, "asprintf|vasprintf (")) {

// todo: check how the return value is used.

if (!Token::Match(tok->previous(), "[;{}]")) {

TokenList::deleteTokens(rethead);

return nullptr;

}

alloc = Malloc;

tok = tok->next()->link();

} else {

alloc = getAllocationType(tok->tokAt(2), varid);

}

if (sz > 1 &&

Token::Match(tok->tokAt(2), "malloc ( %num% )") &&

(MathLib::toLongNumber(tok->strAt(4)) % long(sz)) != 0) {

mismatchSizeError(tok->tokAt(4), tok->strAt(4));

}

if (alloc == CheckMemoryLeak::No) {

alloc = getReallocationType(tok->tokAt(2), varid);

if (alloc != CheckMemoryLeak::No) {

addtoken(&rettail, tok, "realloc");

addtoken(&rettail, tok, ";");

tok = tok->tokAt(2);

if (Token::Match(tok, "%name% ("))

tok = tok->next()->link();

continue;

}

}

// don't check classes..

if (alloc == CheckMemoryLeak::New) {

if (Token::Match(tok->tokAt(2), "new struct| %type% [(;]")) {

const int offset = tok->strAt(3) == "struct" ? 1 : 0;

if (isclass(tok->tokAt(3 + offset), varid)) {

alloc = No;

}

} else if (Token::Match(tok->tokAt(2), "new ( nothrow ) struct| %type%")) {

const int offset = tok->strAt(6) == "struct" ? 1 : 0;

if (isclass(tok->tokAt(6 + offset), varid)) {

alloc = No;

}

} else if (Token::Match(tok->tokAt(2), "new ( std :: nothrow ) struct| %type%")) {

const int offset = tok->strAt(8) == "struct" ? 1 : 0;

if (isclass(tok->tokAt(8 + offset), varid)) {

alloc = No;

}

}

if (Token::simpleMatch(tok->next(), "= new")) {

tok = tok->tokAt(2);

while (Token::Match(tok->next(), "%name%|::|(|[")) {

if (Token::Match(tok->next(), "(|["))

tok = tok->linkAt(1);

else

tok = tok->next();

}

}

if (alloc == No && alloctype == No)

alloctype = CheckMemoryLeak::New;

}

if (alloc != No) {

addtoken(&rettail, tok, "alloc");

if (alloctype != No && alloctype != alloc)

alloc = Many;

if (alloc != Many && dealloctype != No && dealloctype != Many && dealloctype != alloc) {

callstack.push_back(tok);

mismatchAllocDealloc(callstack, Token::findmatch(mTokenizer->tokens(), "%varid%", varid)->str());

callstack.pop_back();

}

alloctype = alloc;

if (Token::Match(tok, "%name% = %type% (")) {

tok = tok->linkAt(3);

continue;

}

}

// assignment..

else {

// is the pointer in rhs?

bool rhs = false;

bool trailingSemicolon = false;

bool used = false;

for (const Token *tok2 = tok->next(); tok2; tok2 = tok2->next()) {

if (tok2->str() == ";") {

trailingSemicolon = true;

if (rhs)

tok = tok2;

break;

}

if (!used && !rhs) {

if (Token::Match(tok2, "[=+(,] %varid%", varid)) {

if (Token::Match(tok2, "[(,]")) {

used = true;

addtoken(&rettail, tok, "use");

addtoken(&rettail, tok, ";");

}

rhs = true;

}

}

}

if (!used) {

if (!rhs)

addtoken(&rettail, tok, "assign");

else {

addtoken(&rettail, tok, "use_");

if (trailingSemicolon)

addtoken(&rettail, tok, ";");

}

}

continue;

}

}

if (Token::Match(tok->previous(), "%op%|;|{|}|) ::| %name%") || (Token::Match(tok->previous(), "( ::| %name%") && (!rettail || rettail->str() != "loop"))) {

if (tok->str() == "::")

tok = tok->next();

if (Token::Match(tok, "%varid% ?", varid))

tok = tok->tokAt(2);

AllocType dealloc = getDeallocationType(tok, varid);

if (dealloc != No && tok->str() == "fcloseall" && alloctype != dealloc)

;

else if (dealloc != No) {

addtoken(&rettail, tok, "dealloc");

if (dealloctype != No && dealloctype != dealloc)

dealloc = Many;

if (dealloc != Many && alloctype != No && alloctype != Many && alloctype != dealloc) {

callstack.push_back(tok);

mismatchAllocDealloc(callstack, Token::findmatch(mTokenizer->tokens(), "%varid%", varid)->str());

callstack.pop_back();

}

dealloctype = dealloc;

if (tok->strAt(2) == "(")

tok = tok->linkAt(2);

continue;

}

}

// if else switch

if (Token::simpleMatch(tok, "if (")) {

if (alloctype == Fd) {

if (ifvar(tok, varid, ">", "-1") ||

ifvar(tok, varid, ">=", "0") ||

ifvar(tok, varid, ">", "0") ||

ifvar(tok, varid, "!=", "-1")) {

addtoken(&rettail, tok, "if(var)");

tok = tok->next()->link();

continue;

} else if (ifvar(tok, varid, "==", "-1") ||

ifvar(tok, varid, "<", "0")) {

addtoken(&rettail, tok, "if(!var)");

tok = tok->next()->link();

continue;

}

}

if (ifvar(tok, varid, "!=", "0")) {

addtoken(&rettail, tok, "if(var)");

// Make sure the "use" will not be added

tok = tok->next()->link();

continue;

} else if (ifvar(tok, varid, "==", "0")) {

addtoken(&rettail, tok, "if(!var)");

// parse the if-body.

// if a variable is assigned then add variable to "extravar".

for (const Token *tok2 = tok->next()->link()->tokAt(2); tok2; tok2 = tok2->next()) {

if (tok2->str() == "{")

tok2 = tok2->link();

else if (tok2->str() == "}")

break;

else if (Token::Match(tok2, "%var% ="))

extravar.insert(tok2->varId());

}

tok = tok->next()->link();

continue;

} else {

// Check if the condition depends on var or extravar somehow..

bool dep = false;

const Token* const end = tok->linkAt(1);

for (const Token *tok2 = tok->next(); tok2 != end; tok2 = tok2->next()) {

if (Token::Match(tok2, "close|pclose|fclose|closedir ( %varid% )", varid)) {

addtoken(&rettail, tok, "dealloc");

addtoken(&rettail, tok, ";");