24 using namespace clang;
29 class MmapWriteExecChecker :
public Checker<check::PreCall> {
35 mutable std::unique_ptr<BugType> BT;
37 MmapWriteExecChecker() : MmapFn(
"mmap", 6), MprotectFn(
"mprotect", 3) {}
44 int MmapWriteExecChecker::ProtWrite = 0x02;
45 int MmapWriteExecChecker::ProtExec = 0x04;
46 int MmapWriteExecChecker::ProtRead = 0x01;
48 void MmapWriteExecChecker::checkPreCall(
const CallEvent &Call,
53 int64_t Prot = ProtLoc->getValue().getSExtValue();
54 if (ProtExecOv != ProtExec)
55 ProtExec = ProtExecOv;
56 if (ProtReadOv != ProtRead)
57 ProtRead = ProtReadOv;
60 if (ProtRead == ProtExec)
63 if ((Prot & (ProtWrite | ProtExec)) == (ProtWrite | ProtExec)) {
65 BT.reset(
new BugType(
this,
"W^X check fails, Write Exec prot flags set",
"Security"));
71 auto Report = llvm::make_unique<BugReport>(
72 *BT,
"Both PROT_WRITE and PROT_EXEC flags are set. This can " 73 "lead to exploitable memory regions, which could be overwritten " 74 "with malicious code", N);
82 MmapWriteExecChecker *Mwec =
Value representing integer constant.
ExplodedNode * generateNonFatalErrorNode(ProgramStateRef State=nullptr, const ProgramPointTag *Tag=nullptr)
Generate a transition to a node that will be used to report an error.
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
CHECKER * registerChecker(AT... Args)
Used to register checkers.
void emitReport(std::unique_ptr< BugReport > R)
Emit the diagnostics report.
This class represents a description of a function call using the number of arguments and the name of ...
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Dataflow Directional Tag Classes.
virtual SourceRange getArgSourceRange(unsigned Index) const
Returns the source range for errors associated with this argument.
Represents an abstract call to a function or method along a particular path.
AnalyzerOptions & getAnalyzerOptions()
bool isCalled(const CallDescription &CD) const
Returns true if the CallEvent is a call to a function that matches the CallDescription.
int getOptionAsInteger(StringRef Name, int DefaultVal, const ento::CheckerBase *C=nullptr, bool SearchInParents=false)
Interprets an option's string value as an integer value.
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.