#include "checkmemoryleak.h"

#include "symboldatabase.h"

#include "mathlib.h"

#include "tokenize.h"

#include "astutils.h"

#include <algorithm>

#include <sstream>

#include <set>

#include <stack>

namespace {

CheckMemoryLeakInFunction instance1;

CheckMemoryLeakInClass instance2;

CheckMemoryLeakStructMember instance3;

CheckMemoryLeakNoVar instance4;

}

static unsigned int countParameters(const Token *tok)

}

static const std::set<std::string> call_func_white_list = make_container < std::set<std::string> > ()

<< "_open" << "_wopen" << "access" << "adjtime" << "asctime" << "asctime_r" << "asprintf" << "assert"

<< "atof" << "atoi" << "atol" << "chdir" << "chmod" << "chown"

<< "clearerr" << "creat" << "ctime" << "ctime_r" << "execl" << "execle"

<< "execlp" << "execv" << "execve" << "fchmod" << "fclose" << "fcntl"

<< "fdatasync" << "feof" << "ferror" << "fflush" << "fgetc" << "fgetpos" << "fgets"

<< "flock" << "fmemopen" << "fnmatch" << "fopen" << "fopencookie" << "for" << "fprintf" << "fputc" << "fputs" << "fread" << "free"

<< "freopen" << "fscanf" << "fseek" << "fseeko" << "fsetpos" << "fstat" << "fsync" << "ftell" << "ftello"

<< "ftruncate" << "fwrite" << "getc" << "getenv" << "getgrnam" << "gethostbyaddr" << "gethostbyname" << "getnetbyname"

<< "getopt" << "getopt_long" << "getprotobyname" << "getpwnam" << "gets" << "getservbyname" << "getservbyport"

<< "glob" << "gmtime" << "gmtime_r" << "if" << "index" << "inet_addr" << "inet_aton" << "inet_network" << "initgroups" << "ioctl"

<< "link" << "localtime" << "localtime_r"

<< "lockf" << "lseek" << "lstat" << "mblen" << "mbstowcs" << "mbtowc" << "memchr" << "memcmp" << "memcpy" << "memmove" << "memset"

<< "mkdir" << "mkfifo" << "mknod" << "mkstemp"

<< "obstack_printf" << "obstack_vprintf" << "open" << "opendir" << "parse_printf_format" << "pathconf"

<< "perror" << "popen" << "posix_fadvise" << "posix_fallocate" << "pread"

<< "printf" << "psignal" << "puts" << "pwrite" << "qsort" << "read" << "readahead" << "readdir" << "readdir_r"

<< "readlink" << "readv"

<< "realloc" << "regcomp" << "remove" << "rename" << "return" << "rewind" << "rewinddir" << "rindex"

<< "rmdir" << "scandir" << "scanf" << "seekdir"

<< "setbuf" << "setbuffer" << "sethostname" << "setlinebuf" << "setlocale" << "setvbuf" << "sizeof" << "snprintf" << "sprintf" << "sscanf"

<< "stat" << "stpcpy" << "strcasecmp" << "strcat" << "strchr" << "strcmp" << "strcoll"

<< "strcpy" << "strcspn" << "strdup" << "stricmp" << "strlen" << "strncasecmp" << "strncat" << "strncmp"

<< "strncpy" << "strpbrk" << "strrchr" << "strspn" << "strstr" << "strtod" << "strtok" << "strtol" << "strtoul" << "strxfrm" << "switch"

<< "symlink" << "sync_file_range" << "system" << "telldir" << "tempnam" << "time" << "typeid" << "unlink"

<< "utime" << "utimes" << "vasprintf" << "vfprintf" << "vfscanf" << "vprintf"

<< "vscanf" << "vsnprintf" << "vsprintf" << "vsscanf" << "while" << "wordexp" << "write" << "writev";

bool CheckMemoryLeak::isclass(const Token *tok, unsigned int varid) const

}

CheckMemoryLeak::AllocType CheckMemoryLeak::getAllocationType(const Token *tok2, unsigned int varid, std::list<const Function*> *callstack) const

}

CheckMemoryLeak::AllocType CheckMemoryLeak::getReallocationType(const Token *tok2, unsigned int varid)

}

CheckMemoryLeak::AllocType CheckMemoryLeak::getDeallocationType(const Token *tok, unsigned int varid) const

}

CheckMemoryLeak::AllocType CheckMemoryLeak::getDeallocationType(const Token *tok, const std::string &varname) const

}

void CheckMemoryLeak::memoryLeak(const Token *tok, const std::string &varname, AllocType alloctype)

}

void CheckMemoryLeak::reportErr(const Token *tok, Severity::SeverityType severity, const std::string &id, const std::string &msg, unsigned int cwe) const

}

void CheckMemoryLeak::reportErr(const std::list<const Token *> &callstack, Severity::SeverityType severity, const std::string &id, const std::string &msg, unsigned int cwe) const

}

void CheckMemoryLeak::memleakError(const Token *tok, const std::string &varname) const

{

reportErr(tok, Severity::error, "memleak", "Memory leak: " + varname, 0U);

}

void CheckMemoryLeak::memleakUponReallocFailureError(const Token *tok, const std::string &varname) const

{

reportErr(tok, Severity::error, "memleakOnRealloc", "Common realloc mistake: \'" + varname + "\' nulled but not freed upon failure", 0U);

}

void CheckMemoryLeak::resourceLeakError(const Token *tok, const std::string &varname) const

}

void CheckMemoryLeak::deallocDeallocError(const Token *tok, const std::string &varname) const

{

reportErr(tok, Severity::error, "deallocDealloc", "Deallocating a deallocated pointer: " + varname, 0U);

}

void CheckMemoryLeak::deallocuseError(const Token *tok, const std::string &varname) const

{

reportErr(tok, Severity::error, "deallocuse", "Dereferencing '" + varname + "' after it is deallocated / released", 0U);

}

void CheckMemoryLeak::mismatchSizeError(const Token *tok, const std::string &sz) const

{

reportErr(tok, Severity::error, "mismatchSize", "The allocated size " + sz + " is not a multiple of the underlying type's size.", 0U);

}

void CheckMemoryLeak::mismatchAllocDealloc(const std::list<const Token *> &callstack, const std::string &varname) const

{

reportErr(callstack, Severity::error, "mismatchAllocDealloc", "Mismatching allocation and deallocation: " + varname, 0U);

}

CheckMemoryLeak::AllocType CheckMemoryLeak::functionReturnType(const Function* func, std::list<const Function*> *callstack) const

}

const char *CheckMemoryLeak::functionArgAlloc(const Function *func, unsigned int targetpar, AllocType &allocType) const

{

allocType = No;

if (!func || !func->functionScope)

return "";

if (!Token::simpleMatch(func->retDef, "void"))

return "";

std::list<Variable>::const_iterator arg = func->argumentList.begin();

for (; arg != func->argumentList.end(); ++arg) {

if (arg->index() == targetpar-1)

break;

}

if (arg == func->argumentList.end())

return "";

// Is **

if (!arg->isPointer())

return "";

const Token* tok = arg->typeEndToken();

tok = tok->previous();

if (tok->str() != "*")

return "";

// Check if pointer is allocated.

int realloc = 0;

for (tok = func->functionScope->classStart; tok && tok != func->functionScope->classEnd; tok = tok->next()) {

if (tok->varId() == arg->declarationId()) {

if (Token::Match(tok->tokAt(-3), "free ( * %name% )")) {

realloc = 1;

allocType = No;

} else if (Token::Match(tok->previous(), "* %name% =")) {

allocType = getAllocationType(tok->tokAt(2), arg->declarationId());

if (allocType == No) {

allocType = getReallocationType(tok->tokAt(2), arg->declarationId());

}

if (allocType != No) {

if (realloc)

return "realloc";

return "alloc";

}

} else {

// unhandled variable usage: bailout

return "";

}

}

}

return "";

}

static bool notvar(const Token *tok, unsigned int varid)

}

static bool ifvar(const Token *tok, unsigned int varid, const std::string &comp, const std::string &rhs)

}

static bool alwaysTrue(const Token *tok)

}

bool CheckMemoryLeakInFunction::test_white_list(const std::string &funcname, const Settings *settings, bool cpp)

{

return ((call_func_white_list.find(funcname)!=call_func_white_list.end()) || (settings->library.leakignore.find(funcname) != settings->library.leakignore.end()) || (cpp && funcname == "delete"));

}

const char * CheckMemoryLeakInFunction::call_func(const Token *tok, std::list<const Token *> callstack, const unsigned int varid, AllocType &alloctype, AllocType &dealloctype, bool &allocpar, unsigned int sz)

{

if (test_white_list(tok->str(), _settings, tokenizer->isCPP())) {

if (tok->str() == "asprintf" ||

tok->str() == "delete" ||

tok->str() == "fclose" ||

tok->str() == "for" ||

tok->str() == "free" ||

tok->str() == "if" ||

tok->str() == "realloc" ||

tok->str() == "return" ||

tok->str() == "switch" ||

tok->str() == "while" ||

tok->str() == "sizeof") {

return 0;

}

// is the varid a parameter?

for (const Token *tok2 = tok->tokAt(2); tok2 != tok->linkAt(1); tok2 = tok2->next()) {

if (tok2->str() == "(") {

tok2 = tok2->nextArgument();

if (!tok2)

break;

}

if (tok2->varId() == varid) {

if (tok->strAt(-1) == ".")

return "use";

else if (tok2->strAt(1) == "=")

return "assign";

else if (tok->str()=="printf")

return "use"; // <- it is not certain printf dereference the pointer TODO: check the format string

else

return "use_";

}

}

return 0;

}

if (_settings->library.isnoreturn(tok) && tok->strAt(-1) != "=")

return "exit";

if (varid > 0 && (getReallocationType(tok, varid) != No || getDeallocationType(tok, varid) != No))

return 0;

if (callstack.size() > 2)

return "dealloc_";

const std::string& funcname(tok->str());

for (std::list<const Token *>::const_iterator it = callstack.begin(); it != callstack.end(); ++it) {

if ((*it) && (*it)->str() == funcname)

return "recursive";

}

callstack.push_back(tok);

// lock/unlock..

if (varid == 0) {

const Function* func = tok->function();

if (!func || !func->hasBody())

return 0;

Token *ftok = getcode(func->functionScope->classStart->next(), callstack, 0, alloctype, dealloctype, false, 1);

simplifycode(ftok);

const char *ret = nullptr;

if (Token::simpleMatch(ftok, "; alloc ; }"))

ret = "alloc";

else if (Token::simpleMatch(ftok, "; dealloc ; }"))

ret = "dealloc";

TokenList::deleteTokens(ftok);

return ret;

}

// how many parameters is there in the function call?

const unsigned int numpar = countParameters(tok);

if (numpar == 0) {

// Taking return value => it is not a noreturn function

if (tok->strAt(-1) == "=")

return nullptr;

// Function is not noreturn

if (tok->function() && tok->function()->functionScope) {

std::string temp;

if (!_settings->library.isScopeNoReturn(tok->function()->functionScope->classEnd, &temp) && temp.empty())

return nullptr;

} else if (_settings->library.isnotnoreturn(tok))

return nullptr;

return "callfunc";

}

unsigned int par = 0;

const bool dot(tok->previous()->str() == ".");

const bool eq(tok->previous()->str() == "=");

const Token *functok = tok;

tok = Token::findsimplematch(tok, "(");

if (tok)

tok = tok->next();

for (; tok; tok = tok->nextArgument()) {

++par;

if (Token::Match(tok, "%varid% [,()]", varid)) {

if (dot)

return "use";

const Function* function = functok->function();

if (!function)

return "use";

// how many parameters does the function want?

if (numpar != function->argCount()) // TODO: Handle default parameters

return "recursive";

if (!function->functionScope)

return "use";

const Variable* param = function->getArgumentVar(par-1);

if (!param || !param->nameToken())

return "use";

Token *func = getcode(function->functionScope->classStart->next(), callstack, param->declarationId(), alloctype, dealloctype, false, sz);

//simplifycode(func);

const Token *func_ = func;

while (func_ && func_->str() == ";")

func_ = func_->next();

const char *ret = nullptr;

/** @todo handle "goto" */

if (Token::findsimplematch(func_, "dealloc"))

ret = "dealloc";

else if (Token::findsimplematch(func_, "use"))

ret = "use";

else if (Token::findsimplematch(func_, "&use"))

ret = "&use";

TokenList::deleteTokens(func);

return ret;

}

if (Token::Match(tok, "& %varid% [,()]", varid)) {

const Function *func = functok->function();

if (func == 0)

continue;

AllocType a;

const char *ret = functionArgAlloc(func, par, a);

if (a != No) {

if (alloctype == No)

alloctype = a;

else if (alloctype != a)

alloctype = Many;

allocpar = true;

return ret;

}

}

if (Token::Match(tok, "%varid% . %name% [,)]", varid))

return "use";

}

return (eq || _settings->experimental) ? 0 : "callfunc";

}

static void addtoken(Token **rettail, const Token *tok, const std::string &str)

}

Token *CheckMemoryLeakInFunction::getcode(const Token *tok, std::list<const Token *> callstack, const unsigned int varid, CheckMemoryLeak::AllocType &alloctype, CheckMemoryLeak::AllocType &dealloctype, bool classmember, unsigned int sz)

{

// variables whose value depends on if(!var). If one of these variables

// is used in a if-condition then generate "ifv" instead of "if".

std::set<unsigned int> extravar;

// The first token should be ";"

Token* rethead = new Token(0);

rethead->str(";");

rethead->linenr(tok->linenr());

rethead->fileIndex(tok->fileIndex());

Token* rettail = rethead;

int indentlevel = 0;

int parlevel = 0;

for (; tok; tok = tok->next()) {

if (tok->str() == "{") {

addtoken(&rettail, tok, "{");

++indentlevel;

} else if (tok->str() == "}") {

addtoken(&rettail, tok, "}");

if (indentlevel <= 0)

break;

--indentlevel;

}

else if (tok->str() == "(")

++parlevel;

else if (tok->str() == ")")

--parlevel;

if (parlevel == 0 && tok->str() == ";")

addtoken(&rettail, tok, ";");

// Start of new statement.. check if the statement has anything interesting

if (varid > 0 && parlevel == 0 && Token::Match(tok, "[;{}]")) {

if (Token::Match(tok->next(), "[{};]"))

continue;

// function calls are interesting..

const Token *tok2 = tok;

while (Token::Match(tok2->next(), "%name% ."))

tok2 = tok2->tokAt(2);

if (Token::Match(tok2->next(), "%name% ("))

;

else if (Token::Match(tok->next(), "continue|break|return|throw|goto|do|else"))

;

else {

const Token *skipToToken = nullptr;

// scan statement for interesting keywords / varid

for (tok2 = tok->next(); tok2; tok2 = tok2->next()) {

if (tok2->str() == ";") {

// nothing interesting found => skip this statement

skipToToken = tok2->previous();

break;

}

if (tok2->varId() == varid ||

tok2->str() == ":" || tok2->str() == "{" || tok2->str() == "}") {

break;

}

}

if (skipToToken) {

tok = skipToToken;

continue;

}

}

}

if (varid == 0) {

if (!callstack.empty() && Token::Match(tok, "[;{}] __cppcheck_lock|__cppcheck_unlock ( ) ;")) {

// Type of leak = Resource leak

alloctype = dealloctype = CheckMemoryLeak::File;

if (tok->next()->str() == "__cppcheck_lock") {

addtoken(&rettail, tok, "alloc");

} else {

addtoken(&rettail, tok, "dealloc");

}

tok = tok->tokAt(3);

continue;

}

if (Token::simpleMatch(tok, "if (")) {

addtoken(&rettail, tok, "if");

tok = tok->next()->link();

continue;

}

} else {

if (Token::Match(tok, "%varid% = close ( %varid% )", varid)) {

addtoken(&rettail, tok, "dealloc");

addtoken(&rettail, tok, ";");

addtoken(&rettail, tok, "assign");

addtoken(&rettail, tok, ";");

tok = tok->tokAt(5);

continue;

}

// var = strcpy|.. ( var ,

if (Token::Match(tok, "[;{}] %varid% = memcpy|memmove|memset|strcpy|strncpy|strcat|strncat ( %varid% ,", varid)) {

tok = tok->linkAt(4);

continue;

}

if (Token::Match(tok->previous(), "[(;{}] %varid% =", varid) ||

Token::Match(tok, "asprintf|vasprintf ( & %varid% ,", varid)) {

CheckMemoryLeak::AllocType alloc;

if (Token::Match(tok, "asprintf|vasprintf (")) {

// todo: check how the return value is used.

if (!Token::Match(tok->previous(), "[;{}]")) {

TokenList::deleteTokens(rethead);

return 0;

}

alloc = Malloc;

tok = tok->next()->link();

} else {

alloc = getAllocationType(tok->tokAt(2), varid);

}

//bool realloc = false;

if (sz > 1 &&

Token::Match(tok->tokAt(2), "malloc ( %num% )") &&

(MathLib::toLongNumber(tok->strAt(4)) % long(sz)) != 0) {

mismatchSizeError(tok->tokAt(4), tok->strAt(4));

}

if (alloc == CheckMemoryLeak::No) {

alloc = getReallocationType(tok->tokAt(2), varid);

if (alloc != CheckMemoryLeak::No) {

addtoken(&rettail, tok, "realloc");

addtoken(&rettail, tok, ";");

//TODO: this assignment is redundant, should be fixed

//realloc = true;

tok = tok->tokAt(2);

if (Token::Match(tok, "%name% ("))

tok = tok->next()->link();

continue;

}

}

// don't check classes..

if (alloc == CheckMemoryLeak::New) {

if (Token::Match(tok->tokAt(2), "new struct| %type% [(;]")) {

const int offset = tok->strAt(3) == "struct" ? 1 : 0;

if (isclass(tok->tokAt(3 + offset), varid)) {

alloc = No;

}

} else if (Token::Match(tok->tokAt(2), "new ( nothrow ) struct| %type%")) {

const int offset = tok->strAt(6) == "struct" ? 1 : 0;

if (isclass(tok->tokAt(6 + offset), varid)) {

alloc = No;

}

} else if (Token::Match(tok->tokAt(2), "new ( std :: nothrow ) struct| %type%")) {

const int offset = tok->strAt(8) == "struct" ? 1 : 0;

if (isclass(tok->tokAt(8 + offset), varid)) {

alloc = No;

}

}

if (alloc == No && alloctype == No)

alloctype = CheckMemoryLeak::New;

}

if (alloc != No) {

//if (! realloc)

addtoken(&rettail, tok, "alloc");

if (alloctype != No && alloctype != alloc)

alloc = Many;

if (alloc != Many && dealloctype != No && dealloctype != Many && dealloctype != alloc) {

callstack.push_back(tok);

mismatchAllocDealloc(callstack, Token::findmatch(_tokenizer->tokens(), "%varid%", varid)->str());

callstack.pop_back();

}

alloctype = alloc;

if (Token::Match(tok, "%name% = %type% (")) {

tok = tok->linkAt(3);

continue;

}

}

// assignment..

else {

// is the pointer in rhs?

bool rhs = false;

bool trailingSemicolon = false;

bool used = false;

for (const Token *tok2 = tok->next(); tok2; tok2 = tok2->next()) {

if (tok2->str() == ";") {

trailingSemicolon = true;

if (rhs)

tok = tok2;

break;

}

if (!used && !rhs) {

if (Token::Match(tok2, "[=+(,] %varid%", varid)) {

if (Token::Match(tok2, "[(,]")) {

used = true;

addtoken(&rettail, tok, "use");

addtoken(&rettail, tok, ";");

}

rhs = true;

}

}

}

if (!used) {

if (!rhs)

addtoken(&rettail, tok, "assign");

else {

addtoken(&rettail, tok, "use_");

if (trailingSemicolon)

addtoken(&rettail, tok, ";");

}

}

continue;

}

}

if (Token::Match(tok->previous(), "%op%|;|{|}|) ::| %name%") || (Token::Match(tok->previous(), "( ::| %name%") && (!rettail || rettail->str() != "loop"))) {

if (Token::Match(tok, "%varid% ?", varid))

tok = tok->tokAt(2);

AllocType dealloc = getDeallocationType(tok, varid);

if (dealloc != No && tok->str() == "fcloseall" && alloctype != dealloc)

//TODO: this assignment is redundant, should be fixed

/*dealloc = No*/;

else if (dealloc != No) {

addtoken(&rettail, tok, "dealloc");

if (dealloctype != No && dealloctype != dealloc)

dealloc = Many;

if (dealloc != Many && alloctype != No && alloctype != Many && alloctype != dealloc) {

callstack.push_back(tok);

mismatchAllocDealloc(callstack, Token::findmatch(_tokenizer->tokens(), "%varid%", varid)->str());

callstack.pop_back();

}

dealloctype = dealloc;

if (tok->strAt(2) == "(")

tok = tok->linkAt(2);

continue;

}

}

// if else switch