#include "checkmemoryleak.h"

#include "mathlib.h"

#include "tokenize.h"

#include "executionpath.h"

#include <algorithm>

#include <cstring>

#include <cstdlib>

#include <iostream>

#include <sstream>

#include <set>

#include <stack>

{

CheckMemoryLeakInFunction instance1;

CheckMemoryLeakInClass instance2;

CheckMemoryLeakStructMember instance3;

CheckMemoryLeakNoVar instance4;

}

static const char * const call_func_white_list[] =

{

"_open", "_wopen", "access", "adjtime", "asctime", "asctime_r", "asprintf", "assert"

, "atof", "atoi", "atol", "chdir", "chmod", "chown"

, "clearerr", "creat", "ctime", "ctime_r", "delete", "execl", "execle"

, "execlp", "execv", "execve", "fchmod", "fclose", "fcntl"

, "fdatasync", "feof", "ferror", "fflush", "fgetc", "fgetpos", "fgets"

, "flock", "fmemopen", "fnmatch", "fopen", "fopencookie", "for", "fprintf", "fputc", "fputs", "fread", "free"

, "freopen", "fscanf", "fseek", "fseeko", "fsetpos", "fstat", "fsync", "ftell", "ftello"

, "ftruncate", "fwrite", "getc", "getenv","getgrnam", "gethostbyaddr", "gethostbyname", "getnetbyname"

, "getopt", "getopt_long", "getprotobyname", "getpwnam", "gets", "getservbyname", "getservbyport"

, "glob", "gmtime", "gmtime_r", "if", "index", "inet_addr", "inet_aton", "inet_network", "initgroups", "ioctl"

, "link", "localtime", "localtime_r"

, "lockf", "lseek", "lstat", "mblen", "mbstowcs", "mbtowc", "memchr", "memcmp", "memcpy", "memmove", "memset"

, "mkdir", "mkfifo", "mknod"

, "obstack_printf", "obstack_vprintf", "open", "opendir", "parse_printf_format", "pathconf"

, "perror", "popen" ,"posix_fadvise", "posix_fallocate", "pread"

, "printf", "psignal", "putenv", "puts", "pwrite", "qsort", "read", "readahead", "readdir", "readdir_r"

, "readlink", "readv"

, "realloc", "regcomp", "remove", "rename", "return", "rewind", "rewinddir", "rindex"

, "rmdir" ,"scandir", "scanf", "seekdir"

, "setbuf", "setbuffer", "sethostname", "setlinebuf", "setlocale" ,"setvbuf", "sizeof" ,"snprintf", "sprintf", "sscanf"

, "stat", "stpcpy", "strcasecmp", "strcat", "strchr", "strcmp", "strcoll"

, "strcpy", "strcspn", "strdup", "stricmp", "strlen", "strncasecmp", "strncat", "strncmp"

, "strncpy", "strpbrk","strrchr", "strspn", "strstr", "strtod", "strtol", "strtoul", "strxfrm", "switch"

, "symlink", "sync_file_range", "system", "telldir", "tempnam", "time", "typeid", "unlink"

, "utime", "utimes", "vasprintf", "vfprintf", "vfscanf", "vprintf"

, "vscanf", "vsnprintf", "vsprintf", "vsscanf", "while", "wordexp","write", "writev"

};

static int call_func_white_list_compare(const void *a, const void *b)

{

return strcmp((const char *)a, *(const char **)b);

}

bool CheckMemoryLeak::isclass(const Tokenizer *_tokenizer, const Token *tok, unsigned int varid) const

}

CheckMemoryLeak::AllocType CheckMemoryLeak::getAllocationType(const Token *tok2, unsigned int varid, std::list<const Token *> *callstack) const

}

CheckMemoryLeak::AllocType CheckMemoryLeak::getReallocationType(const Token *tok2, unsigned int varid) const

}

CheckMemoryLeak::AllocType CheckMemoryLeak::getDeallocationType(const Token *tok, unsigned int varid) const

}

CheckMemoryLeak::AllocType CheckMemoryLeak::getDeallocationType(const Token *tok, const std::string &varname) const

}

void CheckMemoryLeak::memoryLeak(const Token *tok, const std::string &varname, AllocType alloctype)

}

void CheckMemoryLeak::reportErr(const Token *tok, Severity::SeverityType severity, const std::string &id, const std::string &msg) const

}

void CheckMemoryLeak::reportErr(const std::list<const Token *> &callstack, Severity::SeverityType severity, const std::string &id, const std::string &msg) const

}

void CheckMemoryLeak::memleakError(const Token *tok, const std::string &varname)

{

reportErr(tok, Severity::error, "memleak", "Memory leak: " + varname);

}

void CheckMemoryLeak::memleakUponReallocFailureError(const Token *tok, const std::string &varname)

{

reportErr(tok, Severity::error, "memleakOnRealloc", "Common realloc mistake: \'" + varname + "\' nulled but not freed upon failure");

}

void CheckMemoryLeak::resourceLeakError(const Token *tok, const std::string &varname)

}

void CheckMemoryLeak::deallocDeallocError(const Token *tok, const std::string &varname)

{

reportErr(tok, Severity::error, "deallocDealloc", "Deallocating a deallocated pointer: " + varname);

}

void CheckMemoryLeak::deallocuseError(const Token *tok, const std::string &varname)

{

reportErr(tok, Severity::error, "deallocuse", "Dereferencing '" + varname + "' after it is deallocated / released");

}

void CheckMemoryLeak::mismatchSizeError(const Token *tok, const std::string &sz)

{

reportErr(tok, Severity::error, "mismatchSize", "The given size " + sz + " is mismatching");

}

void CheckMemoryLeak::mismatchAllocDealloc(const std::list<const Token *> &callstack, const std::string &varname)

{

reportErr(callstack, Severity::error, "mismatchAllocDealloc", "Mismatching allocation and deallocation: " + varname);

}

CheckMemoryLeak::AllocType CheckMemoryLeak::functionReturnType(const Token *tok, std::list<const Token *> *callstack) const

}

const char *CheckMemoryLeak::functionArgAlloc(const Token *tok, unsigned int targetpar, AllocType &allocType) const

{

// Find the varid of targetpar, then locate the start of the function..

unsigned int parlevel = 0;

unsigned int par = 0;

unsigned int varid = 0;

allocType = No;

while (tok)

{

if (tok->str() == "{" || tok->str() == "}")

return "";

if (tok->str() == "(")

{

if (parlevel != 0)

return "";

++parlevel;

++par;

}

else if (tok->str() == ")")

{

if (parlevel != 1)

return "";

break;

}

else if (parlevel == 1 && tok->str() == ",")

{

++par;

}

tok = tok->next();

if (parlevel == 1 && par == targetpar && Token::Match(tok, "%type% * * %var%"))

{

varid = tok->tokAt(3)->varId();

}

}

if (varid == 0)

return "";

// Is this the start of a function?

if (!Token::Match(tok, ") const| {"))

return "";

while (tok->str() != "{")

tok = tok->next();

// Check if pointer is allocated.

unsigned int indentlevel = 0;

int realloc = 0;

while (0 != (tok = tok->next()))

{

if (tok->str() == "{")

++indentlevel;

else if (tok->str() == "}")

{

if (indentlevel <= 1)

break;

--indentlevel;

}

else if (tok->varId() == varid)

{

if (Token::Match(tok->tokAt(-3), "free ( * %varid% )", varid))

{

realloc = 1;

allocType = No;

}

else if (Token::Match(tok->previous(), "* %varid% =", varid))

{

allocType = getAllocationType(tok->tokAt(2), varid);

if (allocType == No)

{

allocType = getReallocationType(tok->tokAt(2), varid);

}

if (allocType != No)

{

if (realloc)

return "realloc";

return "alloc";

}

}

else

{

// unhandled variable usage: bailout

return "";

}

}

}

return "";

}

void CheckMemoryLeakInFunction::parse_noreturn()

}

bool CheckMemoryLeakInFunction::matchFunctionsThatReturnArg(const Token *tok, unsigned int varid) const

{

return Token::Match(tok, "; %varid% = strcat|memcpy|memmove|strcpy ( %varid% ,", varid);

}

bool CheckMemoryLeakInFunction::notvar(const Token *tok, unsigned int varid, bool endpar) const

}

static int countParameters(const Token *tok)

}

bool CheckMemoryLeakInFunction::test_white_list(const std::string &funcname)

}

const char * CheckMemoryLeakInFunction::call_func(const Token *tok, std::list<const Token *> callstack, const unsigned int varid, AllocType &alloctype, AllocType &dealloctype, bool &allocpar, unsigned int sz)

{

if (test_white_list(tok->str()))

{

if (tok->str() == "asprintf" ||

tok->str() == "delete" ||

tok->str() == "fclose" ||

tok->str() == "for" ||

tok->str() == "free" ||

tok->str() == "if" ||

tok->str() == "realloc" ||

tok->str() == "return" ||

tok->str() == "switch" ||

tok->str() == "while")

{

return 0;

}

// is the varid a parameter?

for (const Token *tok2 = tok->tokAt(2); tok2; tok2 = tok2->next())

{

if (tok2->str() == "(" || tok2->str() == ")")

break;

if (tok2->varId() == varid)

return (tok->strAt(-1)==".") ? "use" : "use_";

}

return 0;

}

if (noreturn.find(tok->str()) != noreturn.end() && tok->strAt(-1) != "=")

return "exit";

if (varid > 0 && (getAllocationType(tok, varid) != No || getReallocationType(tok, varid) != No || getDeallocationType(tok, varid) != No))

return 0;

if (callstack.size() > 2)

return "dealloc_";

const std::string funcname(tok->str());

for (std::list<const Token *>::const_iterator it = callstack.begin(); it != callstack.end(); ++it)

{

if ((*it) && (*it)->str() == funcname)

return "recursive";

}

callstack.push_back(tok);

// lock/unlock..

if (varid == 0)

{

const Token *ftok = _tokenizer->getFunctionTokenByName(funcname.c_str());

while (ftok && (ftok->str() != "{"))

ftok = ftok->next();

if (!ftok)

return 0;

Token *func = getcode(ftok->tokAt(1), callstack, 0, alloctype, dealloctype, false, 1);

simplifycode(func);

const char *ret = 0;

if (Token::simpleMatch(func, "; alloc ; }"))

ret = "alloc";

else if (Token::simpleMatch(func, "; dealloc ; }"))

ret = "dealloc";

Tokenizer::deleteTokens(func);

return ret;

}

// how many parameters is there in the function call?

int numpar = countParameters(tok);

if (numpar <= 0)

{

// Taking return value => it is not a noreturn function

if (tok->strAt(-1) == "=")

return NULL;

// Function is not noreturn

if (notnoreturn.find(funcname) != notnoreturn.end())

return NULL;

return (tok->previous()->str() != "=") ? "callfunc" : NULL;

}

unsigned int par = 1;

unsigned int parlevel = 0;

const bool dot(tok->previous()->str() == ".");

const bool eq(tok->previous()->str() == "=");

for (; tok; tok = tok->next())

{

if (tok->str() == "(")

++parlevel;

else if (tok->str() == ")")

{

--parlevel;

if (parlevel < 1)

{

return (eq || _settings->experimental) ? 0 : "callfunc";

}

}

if (parlevel == 1)

{

if (tok->str() == ",")

++par;

if (varid > 0 && Token::Match(tok, "[,()] %varid% [,()]", varid))

{

if (dot)

return "use";

const Token *ftok = _tokenizer->getFunctionTokenByName(funcname.c_str());

if (!ftok)

return "use";

// how many parameters does the function want?

if (numpar != countParameters(ftok))

return "recursive";

const char *parname = Tokenizer::getParameterName(ftok, par);

if (! parname)

return "recursive";

unsigned int parameterVarid = 0;

{

const Token *partok = Token::findmatch(ftok, parname);

if (partok)

parameterVarid = partok->varId();

}

if (parameterVarid == 0)

return "recursive";

// Check if the function deallocates the variable..

while (ftok && (ftok->str() != "{"))

ftok = ftok->next();

Token *func = getcode(ftok->tokAt(1), callstack, parameterVarid, alloctype, dealloctype, false, sz);

//simplifycode(func, all);

const Token *func_ = func;

while (func_ && func_->str() == ";")

func_ = func_->next();

const char *ret = 0;

/** @todo handle "goto" */

if (Token::findmatch(func_, "dealloc"))

ret = "dealloc";

else if (Token::findmatch(func_, "use"))

ret = "use";

else if (Token::findmatch(func_, "&use"))

ret = "&use";

Tokenizer::deleteTokens(func);

return ret;

}

if (varid > 0 && Token::Match(tok, "[,()] & %varid% [,()]", varid))

{

const Token *ftok = _tokenizer->getFunctionTokenByName(funcname.c_str());

AllocType a;

const char *ret = functionArgAlloc(ftok, par, a);

if (a != No)

{

if (alloctype == No)

alloctype = a;

else if (alloctype != a)

alloctype = Many;

allocpar = true;

return ret;

}

}

}

}

return NULL;

}

static void addtoken(Token **rettail, const Token *tok, const std::string &str)

}

Token *CheckMemoryLeakInFunction::getcode(const Token *tok, std::list<const Token *> callstack, const unsigned int varid, CheckMemoryLeak::AllocType &alloctype, CheckMemoryLeak::AllocType &dealloctype, bool classmember, unsigned int sz)

{

Token *rethead = 0, *rettail = 0;

// variables whose value depends on if(!var). If one of these variables

// is used in a if-condition then generate "ifv" instead of "if".

std::set<unsigned int> extravar;

// The first token should be ";"

rethead = new Token(0);

rethead->str(";");

rethead->linenr(tok->linenr());

rethead->fileIndex(tok->fileIndex());

rettail = rethead;

int indentlevel = 0;

int parlevel = 0;

for (; tok; tok = tok->next())

{

if (tok->str() == "{")

{

addtoken(&rettail, tok, "{");

++indentlevel;

}

else if (tok->str() == "}")

{

addtoken(&rettail, tok, "}");

if (indentlevel <= 0)

break;

--indentlevel;

}

else if (tok->str() == "(")

++parlevel;

else if (tok->str() == ")")

--parlevel;

if (parlevel == 0 && tok->str() == ";")

addtoken(&rettail, tok, ";");

// Start of new statement.. check if the statement has anything interesting

if (Token::Match(tok, "[;{}]") && varid > 0 && parlevel == 0)

{

if (Token::Match(tok->next(), "[{};]"))

continue;

// function calls are interesting..

const Token *tok2 = tok;

while (Token::Match(tok2->next(), "%var% ."))

tok2 = tok2->tokAt(2);

if (Token::Match(tok2->next(), "%var% ("))

;

else if (Token::Match(tok->next(), "continue|break|return|throw|goto|do|else"))

;

else

{

const Token *skipToToken = 0;

// scan statement for interesting keywords / varid

for (tok2 = tok->next(); tok2; tok2 = tok2->next())

{

if (tok2->str() == ";")

{

// nothing interesting found => skip this statement

skipToToken = tok2->previous();

break;

}

if (tok2->varId() == varid ||

tok2->str() == ":" || tok2->str() == "{" || tok2->str() == "}")

{

break;

}

}

if (skipToToken)

{

tok = skipToToken;

continue;

}

}

}

if (varid == 0)

{

if (!callstack.empty() && Token::Match(tok, "[;{}] __cppcheck_lock|__cppcheck_unlock ( ) ;"))

{

// Type of leak = Resource leak

alloctype = dealloctype = CheckMemoryLeak::File;

if (tok->next()->str() == "__cppcheck_lock")

{

addtoken(&rettail, tok, "alloc");

}

else

{

addtoken(&rettail, tok, "dealloc");

}

tok = tok->tokAt(3);

continue;

}

if (Token::simpleMatch(tok, "if ("))

{

addtoken(&rettail, tok, "if");

tok = tok->next()->link();

continue;

}

}

else

{

if (Token::Match(tok, "%varid% = close ( %varid% )", varid))

{

addtoken(&rettail, tok, "dealloc");

addtoken(&rettail, tok, ";");

addtoken(&rettail, tok, "assign");

addtoken(&rettail, tok, ";");

tok = tok->tokAt(5);

continue;

}

// var = strcpy|.. ( var ,

if (Token::Match(tok, "[;{}] %varid% = memcpy|memmove|memset|strcpy|strncpy|strcat|strncat ( %varid% ,", varid))

{

tok = tok->tokAt(4)->link();

continue;

}

if (Token::Match(tok->previous(), "[(;{}] %varid% =", varid) ||

Token::Match(tok, "asprintf ( & %varid% ,", varid))

{

CheckMemoryLeak::AllocType alloc;

if (Token::simpleMatch(tok, "asprintf ("))

{

// todo: check how the return value is used.

if (!Token::Match(tok->previous(), "[;{}]"))

{