[-Wunsafe-buffer-usage] Accept calls to some libc functions with annotated arguments #10088

ziqingluo-90 · 2025-02-21T19:08:52Z

printf, fprintf snprintf functions accept __null_terminated
snprintf function accepts __counted_by/__sized_by
functions consuming a single string pointer like strlen or atoi accept __null_terminated

Generalized isCountAttributedPointerArgumentSafe so that it is shared by interoperation gadgets and the unsafe libc gadget.

(A follow-up change to rdar://138798346)

…tated arguments - `printf`, `fprintf` `snprintf` functions accept `__null_terminated` - `snprintf` function accepts `__counted_by/__sized_by` - functions consuming a single string pointer like `strlen` or `atoi` accept `__null_terminated` Generalized `isCountAttributedPointerArgumentSafe` so that it is shared by interoperation gadgets and the unsafe libc gadget. (A follow-up change to rdar://138798346)

ziqingluo-90 · 2025-02-21T19:09:39Z

CC @dtarditi

ziqingluo-90 · 2025-02-21T19:10:24Z

This PR depends on #10060

ziqingluo-90 · 2025-02-21T21:57:58Z

clang/lib/Analysis/UnsafeBufferUsage.cpp

@@ -747,7 +747,7 @@ const Expr *extractExtentFromSubviewDataCall(ASTContext &Context,
 static bool hasIntegeralConstant(const Expr *E, uint64_t Val, ASTContext &Ctx) {
  Expr::EvalResult ER;

-  if (E->EvaluateAsConstantExpr(ER, Ctx)) {
+  if (E->EvaluateAsInt(ER, Ctx)) {


According to https://github.com/llvm/llvm-project/pull/124022/files, the result of EvaluateAsConstantExpr may not necessarily be able to getInt() later.

ziqingluo-90 · 2025-02-21T22:01:07Z

clang/test/SemaCXX/warn-unsafe-buffer-usage-libc-functions-inline-namespace.cpp

@@ -23,7 +23,7 @@ namespace std {
    T* p;
    T *c_str();
    T *data();
-    unsigned size_bytes();


A mistake I made in the test---std::string has no size_bytes method.

It's probably worth checking if basic_string<wchar_t> works as expected.

ziqingluo-90 · 2025-02-22T00:24:14Z

clang/lib/Analysis/UnsafeBufferUsage.cpp

@@ -366,6 +366,7 @@ isInUnspecifiedUntypedContext(internal::Matcher<Stmt> InnerMatcher) {

 namespace {

+/* TO_UPSTREAM(BoundsSafetyInterop) ON */


I assume there is no problem in upstreaming the part of the interop in UnsafeBufferUsage.cpp? @patrykstefanski

Yup, this is fine.

ziqingluo-90 · 2025-02-24T19:54:43Z

add @jkorous-apple

patrykstefanski · 2025-02-24T22:13:54Z

clang/test/SemaCXX/warn-unsafe-buffer-usage-libc-functions-interop.cpp

+  snwprintf(safe_p, n, "%s", str); // expected-warning{{function 'snwprintf' is unsafe}} expected-note{{string argument is not guaranteed to be null-terminated}}
+
+  memcpy(safe_p, safe_p, n);               // no warn
+  strlen(str);                             // expected-warning{{unsafe assignment to a parameter of '__null_terminated' type; only '__null_terminated' pointers, string literals, and 'std::string::c_str' calls are compatible with '__null_terminated' pointers}}


I'm not getting this warning here.

error: 'expected-warning' diagnostics expected but not seen: File ./clang/test/SemaCXX/warn-unsafe-buffer-usage-libc-functions-interop.cpp Line 36: unsafe assignment to a parameter of '__null_terminated' type; only '__null_terminated' pointers, string literals, and 'std::string::c_str' calls are compatible with '__null_terminated' pointers

patrykstefanski · 2025-02-24T23:50:47Z

clang/lib/Analysis/UnsafeBufferUsage.cpp

-                                   &*ValuesOpt, Context);
+  return isCountAttributedPointerArgumentSafeImpl(
+      Context, Arg, CountArg, CAT, CAT->getCountExpr(), CAT->isCountInBytes(),
+      CAT->isOrNull(), ValuesOpt ? &*ValuesOpt : nullptr);


Nit: IMHO we could be explicit to avoid any confusion: ValuesOpt.has_value() ? &*ValuesOpt : nullptr.

patrykstefanski · 2025-02-25T00:02:40Z

clang/lib/Analysis/UnsafeBufferUsage.cpp

+  assert(CountedByExpr ||
+         !DependentValueMap &&
+             "If the __counted_by information is hardcoded, there is no "
+             "dependent value map.");


Is the operator precedence in those 2 asserts correct? The bottom one is equivalent to:

CountedByExpr || (!DependentValueMap && "If the __counted_by information is hardcoded, there is no " "dependent value map.")

Is this expected?

patrykstefanski · 2025-02-25T00:12:06Z

clang/lib/Analysis/UnsafeBufferUsage.cpp

-  auto ValuesOpt = getDependentValuesFromCall(CAT, Call);
-  if (!ValuesOpt.has_value())
+  if (!DependentValueMap && CountedByExpr)
+    // Bail if the map is not available for case (a). Becuase


Becuase -> Because.

patrykstefanski · 2025-02-25T00:12:22Z

clang/lib/Analysis/UnsafeBufferUsage.cpp

    return false;

-  const Expr *ArgCount = nullptr;
+  // the acutal count of the pointer inferred through patterns below:


acutal -> actual

patrykstefanski · 2025-02-25T00:44:36Z

clang/test/SemaCXX/warn-unsafe-buffer-usage-libc-functions-interop.cpp

+
+// expected-note@+2{{consider using a safe container and passing '.data()' to the parameter 'dst' and '.size()' to its dependent parameter 'size' or 'std::span' and passing '.first(...).data()' to the parameter 'dst'}}
+// expected-note@+1{{consider using a safe container and passing '.data()' to the parameter 'src' and '.size()' to its dependent parameter 'size' or 'std::span' and passing '.first(...).data()' to the parameter 'src'}}
+void memcpy(void * __sized_by(size) dst, const void * __sized_by(size) src, unsigned size);


memcpy returns void * and takes size_t size.

patrykstefanski · 2025-02-25T00:45:55Z

clang/test/SemaCXX/warn-unsafe-buffer-usage-libc-functions-interop.cpp

+void memcpy(void * __sized_by(size) dst, const void * __sized_by(size) src, unsigned size);
+unsigned strlen( const char* __null_terminated str );
+// expected-note@+1{{consider using a safe container and passing '.data()' to the parameter 'buffer' and '.size()' to its dependent parameter 'buf_size' or 'std::span' and passing '.first(...).data()' to the parameter 'buffer'}}
+int snprintf( char* __counted_by(buf_size) buffer, unsigned buf_size, const char* format, ... );


Nit: Those printf functions take size_t.

patrykstefanski · 2025-02-25T00:47:30Z

clang/test/SemaCXX/warn-unsafe-buffer-usage-libc-functions-interop.cpp

+// expected-note@+1{{consider using a safe container and passing '.data()' to the parameter 'buffer' and '.size()' to its dependent parameter 'buf_size' or 'std::span' and passing '.first(...).data()' to the parameter 'buffer'}}
+int snprintf( char* __counted_by(buf_size) buffer, unsigned buf_size, const char* format, ... );
+int snwprintf( char* __counted_by(buf_size) buffer, unsigned buf_size, const char* format, ... );
+int vsnprintf( char* __counted_by(buf_size) buffer, unsigned buf_size, const char* format, ... );


Should take va_list vlist instead of ....

patrykstefanski · 2025-02-25T01:12:11Z

clang/lib/Analysis/UnsafeBufferUsage.cpp

-  }
-  return true; // ptr and size are not in safe pattern
+  return !isHardcodedCountedByPointerArgumentSafe(
+      Finder->getASTContext(), Buf, Size, FirstParmTy.getTypePtr(), true,


Is true passed to isSizedBy correct here? I think the functions taking wchar_t would be annotated with __counted_by().

patrykstefanski · 2025-02-25T01:14:56Z

clang/test/SemaCXX/warn-unsafe-buffer-usage-libc-functions-inline-namespace.cpp

@@ -23,7 +23,7 @@ namespace std {
    T* p;
    T *c_str();
    T *data();
-    unsigned size_bytes();


It's probably worth checking if basic_string<wchar_t> works as expected.

ziqingluo-90 requested review from malavikasamak and patrykstefanski February 21, 2025 19:08

ziqingluo-90 commented Feb 21, 2025

View reviewed changes

Mark code in UnsafeBufferUsage.cpp that needs upstream

306ea22

ziqingluo-90 commented Feb 22, 2025

View reviewed changes

ziqingluo-90 requested review from t-rasmud, hnrklssn and rapidsna February 24, 2025 19:54

patrykstefanski reviewed Feb 25, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[-Wunsafe-buffer-usage] Accept calls to some libc functions with annotated arguments #10088

[-Wunsafe-buffer-usage] Accept calls to some libc functions with annotated arguments #10088

ziqingluo-90 commented Feb 21, 2025

ziqingluo-90 commented Feb 21, 2025

ziqingluo-90 commented Feb 21, 2025

ziqingluo-90 Feb 21, 2025

ziqingluo-90 Feb 21, 2025

patrykstefanski Feb 25, 2025

ziqingluo-90 Feb 22, 2025

patrykstefanski Feb 25, 2025

ziqingluo-90 commented Feb 24, 2025

patrykstefanski Feb 24, 2025

patrykstefanski Feb 24, 2025

patrykstefanski Feb 25, 2025

patrykstefanski Feb 25, 2025

patrykstefanski Feb 25, 2025

patrykstefanski Feb 25, 2025

patrykstefanski Feb 25, 2025

patrykstefanski Feb 25, 2025

patrykstefanski Feb 25, 2025

patrykstefanski Feb 25, 2025

		@@ -366,6 +366,7 @@ isInUnspecifiedUntypedContext(internal::Matcher<Stmt> InnerMatcher) {

		namespace {

		/* TO_UPSTREAM(BoundsSafetyInterop) ON */

[-Wunsafe-buffer-usage] Accept calls to some libc functions with annotated arguments #10088

Are you sure you want to change the base?

[-Wunsafe-buffer-usage] Accept calls to some libc functions with annotated arguments #10088

Conversation

ziqingluo-90 commented Feb 21, 2025

ziqingluo-90 commented Feb 21, 2025

ziqingluo-90 commented Feb 21, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ziqingluo-90 commented Feb 24, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment