#include "checkmemoryleak.h"

#include "symboldatabase.h"

#include "mathlib.h"

#include "tokenize.h"

#include <algorithm>

#include <sstream>

#include <set>

#include <stack>

namespace {

CheckMemoryLeakInFunction instance1;

CheckMemoryLeakInClass instance2;

CheckMemoryLeakStructMember instance3;

CheckMemoryLeakNoVar instance4;

}

static unsigned int countParameters(const Token *tok)

}

static const char * const call_func_white_list[] = {

"_open", "_wopen", "access", "adjtime", "asctime", "asctime_r", "asprintf", "assert"

, "atof", "atoi", "atol", "chdir", "chmod", "chown"

, "clearerr", "creat", "ctime", "ctime_r", "execl", "execle"

, "execlp", "execv", "execve", "fchmod", "fclose", "fcntl"

, "fdatasync", "feof", "ferror", "fflush", "fgetc", "fgetpos", "fgets"

, "flock", "fmemopen", "fnmatch", "fopen", "fopencookie", "for", "fprintf", "fputc", "fputs", "fread", "free"

, "freopen", "fscanf", "fseek", "fseeko", "fsetpos", "fstat", "fsync", "ftell", "ftello"

, "ftruncate", "fwrite", "getc", "getenv","getgrnam", "gethostbyaddr", "gethostbyname", "getnetbyname"

, "getopt", "getopt_long", "getprotobyname", "getpwnam", "gets", "getservbyname", "getservbyport"

, "glob", "gmtime", "gmtime_r", "if", "index", "inet_addr", "inet_aton", "inet_network", "initgroups", "ioctl"

, "link", "localtime", "localtime_r"

, "lockf", "lseek", "lstat", "mblen", "mbstowcs", "mbtowc", "memchr", "memcmp", "memcpy", "memmove", "memset"

, "mkdir", "mkfifo", "mknod", "mkstemp"

, "obstack_printf", "obstack_vprintf", "open", "opendir", "parse_printf_format", "pathconf"

, "perror", "popen" ,"posix_fadvise", "posix_fallocate", "pread"

, "printf", "psignal", "puts", "pwrite", "qsort", "read", "readahead", "readdir", "readdir_r"

, "readlink", "readv"

, "realloc", "regcomp", "remove", "rename", "return", "rewind", "rewinddir", "rindex"

, "rmdir" ,"scandir", "scanf", "seekdir"

, "setbuf", "setbuffer", "sethostname", "setlinebuf", "setlocale" ,"setvbuf", "sizeof" ,"snprintf", "sprintf", "sscanf"

, "stat", "stpcpy", "strcasecmp", "strcat", "strchr", "strcmp", "strcoll"

, "strcpy", "strcspn", "strdup", "stricmp", "strlen", "strncasecmp", "strncat", "strncmp"

, "strncpy", "strpbrk","strrchr", "strspn", "strstr", "strtod", "strtok", "strtol", "strtoul", "strxfrm", "switch"

, "symlink", "sync_file_range", "system", "telldir", "tempnam", "time", "typeid", "unlink"

, "utime", "utimes", "vasprintf", "vfprintf", "vfscanf", "vprintf"

, "vscanf", "vsnprintf", "vsprintf", "vsscanf", "while", "wordexp","write", "writev"

};

bool CheckMemoryLeak::isclass(const Token *tok, unsigned int varid) const

}

CheckMemoryLeak::AllocType CheckMemoryLeak::getAllocationType(const Token *tok2, unsigned int varid, std::list<const Function*> *callstack) const

}

CheckMemoryLeak::AllocType CheckMemoryLeak::getReallocationType(const Token *tok2, unsigned int varid)

}

CheckMemoryLeak::AllocType CheckMemoryLeak::getDeallocationType(const Token *tok, unsigned int varid) const

}

CheckMemoryLeak::AllocType CheckMemoryLeak::getDeallocationType(const Token *tok, const std::string &varname) const

}

void CheckMemoryLeak::memoryLeak(const Token *tok, const std::string &varname, AllocType alloctype)

}

void CheckMemoryLeak::reportErr(const Token *tok, Severity::SeverityType severity, const std::string &id, const std::string &msg, unsigned int cwe) const

}

void CheckMemoryLeak::reportErr(const std::list<const Token *> &callstack, Severity::SeverityType severity, const std::string &id, const std::string &msg, unsigned int cwe) const

}

void CheckMemoryLeak::memleakError(const Token *tok, const std::string &varname) const

{

reportErr(tok, Severity::error, "memleak", "Memory leak: " + varname, 0U);

}

void CheckMemoryLeak::memleakUponReallocFailureError(const Token *tok, const std::string &varname) const

{

reportErr(tok, Severity::error, "memleakOnRealloc", "Common realloc mistake: \'" + varname + "\' nulled but not freed upon failure", 0U);

}

void CheckMemoryLeak::resourceLeakError(const Token *tok, const std::string &varname) const

}

void CheckMemoryLeak::deallocDeallocError(const Token *tok, const std::string &varname) const

{

reportErr(tok, Severity::error, "deallocDealloc", "Deallocating a deallocated pointer: " + varname, 0U);

}

void CheckMemoryLeak::deallocuseError(const Token *tok, const std::string &varname) const

{

reportErr(tok, Severity::error, "deallocuse", "Dereferencing '" + varname + "' after it is deallocated / released", 0U);

}

void CheckMemoryLeak::mismatchSizeError(const Token *tok, const std::string &sz) const

{

reportErr(tok, Severity::error, "mismatchSize", "The allocated size " + sz + " is not a multiple of the underlying type's size.", 0U);

}

void CheckMemoryLeak::mismatchAllocDealloc(const std::list<const Token *> &callstack, const std::string &varname) const

{

reportErr(callstack, Severity::error, "mismatchAllocDealloc", "Mismatching allocation and deallocation: " + varname, 0U);

}

CheckMemoryLeak::AllocType CheckMemoryLeak::functionReturnType(const Function* func, std::list<const Function*> *callstack) const

}

const char *CheckMemoryLeak::functionArgAlloc(const Function *func, unsigned int targetpar, AllocType &allocType) const

{

allocType = No;

if (!func || !func->functionScope)

return "";

if (!Token::simpleMatch(func->retDef, "void"))

return "";

std::list<Variable>::const_iterator arg = func->argumentList.begin();

for (; arg != func->argumentList.end(); ++arg) {

if (arg->index() == targetpar-1)

break;

}

if (arg == func->argumentList.end())

return "";

// Is **

if (!arg->isPointer())

return "";

const Token* tok = arg->typeEndToken();

tok = tok->previous();

if (tok->str() != "*")

return "";

// Check if pointer is allocated.

int realloc = 0;

for (tok = func->functionScope->classStart; tok && tok != func->functionScope->classEnd; tok = tok->next()) {

if (tok->varId() == arg->declarationId()) {

if (Token::Match(tok->tokAt(-3), "free ( * %name% )")) {

realloc = 1;

allocType = No;

} else if (Token::Match(tok->previous(), "* %name% =")) {

allocType = getAllocationType(tok->tokAt(2), arg->declarationId());

if (allocType == No) {

allocType = getReallocationType(tok->tokAt(2), arg->declarationId());

}

if (allocType != No) {

if (realloc)

return "realloc";

return "alloc";

}

} else {

// unhandled variable usage: bailout

return "";

}

}

}

return "";

}

bool CheckMemoryLeakInFunction::notvar(const Token *tok, unsigned int varid, bool endpar)

}

bool CheckMemoryLeakInFunction::test_white_list(const std::string &funcname, const Settings *settings, bool cpp)

}

const char * CheckMemoryLeakInFunction::call_func(const Token *tok, std::list<const Token *> callstack, const unsigned int varid, AllocType &alloctype, AllocType &dealloctype, bool &allocpar, unsigned int sz)

{

if (test_white_list(tok->str(), _settings, tokenizer->isCPP())) {

if (tok->str() == "asprintf" ||

tok->str() == "delete" ||

tok->str() == "fclose" ||

tok->str() == "for" ||

tok->str() == "free" ||

tok->str() == "if" ||

tok->str() == "realloc" ||

tok->str() == "return" ||

tok->str() == "switch" ||

tok->str() == "while" ||

tok->str() == "sizeof") {

return 0;

}

// is the varid a parameter?

for (const Token *tok2 = tok->tokAt(2); tok2 != tok->linkAt(1); tok2 = tok2->next()) {

if (tok2->str() == "(") {

tok2 = tok2->nextArgument();

if (!tok2)

break;

}

if (tok2->varId() == varid) {

if (tok->strAt(-1) == ".")

return "use";

else if (tok2->strAt(1) == "=")

return "assign";

else if (tok->str()=="printf")

return "use"; // <- it is not certain printf dereference the pointer TODO: check the format string

else

return "use_";

}

}

return 0;

}

if (_settings->library.isnoreturn(tok) && tok->strAt(-1) != "=")

return "exit";

if (varid > 0 && (getReallocationType(tok, varid) != No || getDeallocationType(tok, varid) != No))

return 0;

if (callstack.size() > 2)

return "dealloc_";

const std::string& funcname(tok->str());

for (std::list<const Token *>::const_iterator it = callstack.begin(); it != callstack.end(); ++it) {

if ((*it) && (*it)->str() == funcname)

return "recursive";

}

callstack.push_back(tok);

// lock/unlock..

if (varid == 0) {

const Function* func = tok->function();

if (!func || !func->hasBody())

return 0;

Token *ftok = getcode(func->functionScope->classStart->next(), callstack, 0, alloctype, dealloctype, false, 1);

simplifycode(ftok);

const char *ret = nullptr;

if (Token::simpleMatch(ftok, "; alloc ; }"))

ret = "alloc";

else if (Token::simpleMatch(ftok, "; dealloc ; }"))

ret = "dealloc";

TokenList::deleteTokens(ftok);

return ret;

}

// how many parameters is there in the function call?

const unsigned int numpar = countParameters(tok);

if (numpar == 0) {

// Taking return value => it is not a noreturn function

if (tok->strAt(-1) == "=")

return nullptr;

// Function is not noreturn

if (tok->function() && tok->function()->functionScope) {

std::string temp;

if (!_settings->library.isScopeNoReturn(tok->function()->functionScope->classEnd, &temp) && temp.empty())

return nullptr;

} else if (_settings->library.isnotnoreturn(tok))

return nullptr;

return "callfunc";

}

unsigned int par = 0;

const bool dot(tok->previous()->str() == ".");

const bool eq(tok->previous()->str() == "=");

const Token *functok = tok;

tok = Token::findsimplematch(tok, "(");

if (tok)

tok = tok->next();

for (; tok; tok = tok->nextArgument()) {

++par;

if (Token::Match(tok, "%varid% [,()]", varid)) {

if (dot)

return "use";

const Function* function = functok->function();

if (!function)

return "use";

// how many parameters does the function want?

if (numpar != function->argCount()) // TODO: Handle default parameters

return "recursive";

if (!function->functionScope)

return "use";

const Variable* param = function->getArgumentVar(par-1);

if (!param || !param->nameToken())

return "use";

Token *func = getcode(function->functionScope->classStart->next(), callstack, param->declarationId(), alloctype, dealloctype, false, sz);

//simplifycode(func);

const Token *func_ = func;

while (func_ && func_->str() == ";")

func_ = func_->next();

const char *ret = nullptr;

/** @todo handle "goto" */

if (Token::findsimplematch(func_, "dealloc"))

ret = "dealloc";

else if (Token::findsimplematch(func_, "use"))

ret = "use";

else if (Token::findsimplematch(func_, "&use"))

ret = "&use";

TokenList::deleteTokens(func);

return ret;

}

if (Token::Match(tok, "& %varid% [,()]", varid)) {

const Function *func = functok->function();

if (func == 0)

continue;

AllocType a;

const char *ret = functionArgAlloc(func, par, a);

if (a != No) {

if (alloctype == No)

alloctype = a;

else if (alloctype != a)

alloctype = Many;

allocpar = true;

return ret;

}

}

if (Token::Match(tok, "%varid% . %name% [,)]", varid))

return "use";

}

return (eq || _settings->experimental) ? 0 : "callfunc";

}

static void addtoken(Token **rettail, const Token *tok, const std::string &str)

}

Token *CheckMemoryLeakInFunction::getcode(const Token *tok, std::list<const Token *> callstack, const unsigned int varid, CheckMemoryLeak::AllocType &alloctype, CheckMemoryLeak::AllocType &dealloctype, bool classmember, unsigned int sz)

{

// variables whose value depends on if(!var). If one of these variables

// is used in a if-condition then generate "ifv" instead of "if".

std::set<unsigned int> extravar;

// The first token should be ";"

Token* rethead = new Token(0);

rethead->str(";");

rethead->linenr(tok->linenr());

rethead->fileIndex(tok->fileIndex());

Token* rettail = rethead;

int indentlevel = 0;

int parlevel = 0;

for (; tok; tok = tok->next()) {

if (tok->str() == "{") {

addtoken(&rettail, tok, "{");

++indentlevel;

} else if (tok->str() == "}") {

addtoken(&rettail, tok, "}");

if (indentlevel <= 0)

break;

--indentlevel;

}

else if (tok->str() == "(")

++parlevel;

else if (tok->str() == ")")

--parlevel;

if (parlevel == 0 && tok->str() == ";")

addtoken(&rettail, tok, ";");

// Start of new statement.. check if the statement has anything interesting

if (varid > 0 && parlevel == 0 && Token::Match(tok, "[;{}]")) {

if (Token::Match(tok->next(), "[{};]"))

continue;

// function calls are interesting..

const Token *tok2 = tok;

while (Token::Match(tok2->next(), "%name% ."))

tok2 = tok2->tokAt(2);

if (Token::Match(tok2->next(), "%name% ("))

;

else if (Token::Match(tok->next(), "continue|break|return|throw|goto|do|else"))

;

else {

const Token *skipToToken = nullptr;

// scan statement for interesting keywords / varid

for (tok2 = tok->next(); tok2; tok2 = tok2->next()) {

if (tok2->str() == ";") {

// nothing interesting found => skip this statement

skipToToken = tok2->previous();

break;

}

if (tok2->varId() == varid ||

tok2->str() == ":" || tok2->str() == "{" || tok2->str() == "}") {

break;

}

}

if (skipToToken) {

tok = skipToToken;

continue;

}

}

}

if (varid == 0) {

if (!callstack.empty() && Token::Match(tok, "[;{}] __cppcheck_lock|__cppcheck_unlock ( ) ;")) {

// Type of leak = Resource leak

alloctype = dealloctype = CheckMemoryLeak::File;

if (tok->next()->str() == "__cppcheck_lock") {

addtoken(&rettail, tok, "alloc");

} else {

addtoken(&rettail, tok, "dealloc");

}

tok = tok->tokAt(3);

continue;

}

if (Token::simpleMatch(tok, "if (")) {

addtoken(&rettail, tok, "if");

tok = tok->next()->link();

continue;

}

} else {

if (Token::Match(tok, "%varid% = close ( %varid% )", varid)) {

addtoken(&rettail, tok, "dealloc");

addtoken(&rettail, tok, ";");

addtoken(&rettail, tok, "assign");

addtoken(&rettail, tok, ";");

tok = tok->tokAt(5);

continue;

}

// var = strcpy|.. ( var ,

if (Token::Match(tok, "[;{}] %varid% = memcpy|memmove|memset|strcpy|strncpy|strcat|strncat ( %varid% ,", varid)) {

tok = tok->linkAt(4);

continue;

}

if (Token::Match(tok->previous(), "[(;{}] %varid% =", varid) ||

Token::Match(tok, "asprintf|vasprintf ( & %varid% ,", varid)) {

CheckMemoryLeak::AllocType alloc;

if (Token::Match(tok, "asprintf|vasprintf (")) {

// todo: check how the return value is used.

if (!Token::Match(tok->previous(), "[;{}]")) {

TokenList::deleteTokens(rethead);

return 0;

}

alloc = Malloc;

tok = tok->next()->link();

} else {

alloc = getAllocationType(tok->tokAt(2), varid);

}

//bool realloc = false;

if (sz > 1 &&

Token::Match(tok->tokAt(2), "malloc ( %num% )") &&

(MathLib::toLongNumber(tok->strAt(4)) % long(sz)) != 0) {

mismatchSizeError(tok->tokAt(4), tok->strAt(4));

}

if (alloc == CheckMemoryLeak::No) {

alloc = getReallocationType(tok->tokAt(2), varid);

if (alloc != CheckMemoryLeak::No) {

addtoken(&rettail, tok, "realloc");

addtoken(&rettail, tok, ";");

//TODO: this assignment is redundant, should be fixed

//realloc = true;

tok = tok->tokAt(2);

if (Token::Match(tok, "%name% ("))

tok = tok->next()->link();

continue;

}

}

// don't check classes..

if (alloc == CheckMemoryLeak::New) {

if (Token::Match(tok->tokAt(2), "new struct| %type% [(;]")) {

const int offset = tok->strAt(3) == "struct" ? 1 : 0;

if (isclass(tok->tokAt(3 + offset), varid)) {

alloc = No;

}

} else if (Token::Match(tok->tokAt(2), "new ( nothrow ) struct| %type%")) {

const int offset = tok->strAt(6) == "struct" ? 1 : 0;

if (isclass(tok->tokAt(6 + offset), varid)) {

alloc = No;

}

} else if (Token::Match(tok->tokAt(2), "new ( std :: nothrow ) struct| %type%")) {

const int offset = tok->strAt(8) == "struct" ? 1 : 0;

if (isclass(tok->tokAt(8 + offset), varid)) {

alloc = No;

}

}

if (alloc == No && alloctype == No)

alloctype = CheckMemoryLeak::New;

}

if (alloc != No) {

//if (! realloc)

addtoken(&rettail, tok, "alloc");

if (alloctype != No && alloctype != alloc)

alloc = Many;

if (alloc != Many && dealloctype != No && dealloctype != Many && dealloctype != alloc) {

callstack.push_back(tok);

mismatchAllocDealloc(callstack, Token::findmatch(_tokenizer->tokens(), "%varid%", varid)->str());

callstack.pop_back();

}

alloctype = alloc;

if (Token::Match(tok, "%name% = %type% (")) {

tok = tok->linkAt(3);

continue;

}

}

// assignment..

else {

// is the pointer in rhs?

bool rhs = false;

bool trailingSemicolon = false;

bool used = false;

for (const Token *tok2 = tok->next(); tok2; tok2 = tok2->next()) {

if (tok2->str() == ";") {

trailingSemicolon = true;

if (rhs)

tok = tok2;

break;

}

if (!used && !rhs) {

if (Token::Match(tok2, "[=+(,] %varid%", varid)) {

if (Token::Match(tok2, "[(,]")) {

used = true;

addtoken(&rettail, tok, "use");

addtoken(&rettail, tok, ";");

}

rhs = true;

}

}

}

if (!used) {

if (!rhs)

addtoken(&rettail, tok, "assign");

else {

addtoken(&rettail, tok, "use_");

if (trailingSemicolon)

addtoken(&rettail, tok, ";");

}

}

continue;

}

}

if (Token::Match(tok->previous(), "%op%|;|{|}|) ::| %name%") || (Token::Match(tok->previous(), "( ::| %name%") && (!rettail || rettail->str() != "loop"))) {

if (Token::Match(tok, "%varid% ?", varid))

tok = tok->tokAt(2);

AllocType dealloc = getDeallocationType(tok, varid);

if (dealloc != No && tok->str() == "fcloseall" && alloctype != dealloc)

//TODO: this assignment is redundant, should be fixed

/*dealloc = No*/;

else if (dealloc != No) {

addtoken(&rettail, tok, "dealloc");

if (dealloctype != No && dealloctype != dealloc)

dealloc = Many;

if (dealloc != Many && alloctype != No && alloctype != Many && alloctype != dealloc) {

callstack.push_back(tok);

mismatchAllocDealloc(callstack, Token::findmatch(_tokenizer->tokens(), "%varid%", varid)->str());

callstack.pop_back();

}

dealloctype = dealloc;

if (tok->strAt(2) == "(")

tok = tok->linkAt(2);

continue;

}

}

// if else switch

if (Token::simpleMatch(tok, "if (")) {

if (alloctype == Fd) {

if (Token::Match(tok, "if ( 0|-1 <=|< %varid% )", varid) ||

Token::Match(tok, "if ( %varid% >|>= 0|-1 )", varid) ||

Token::Match(tok, "if ( %varid% != -1 )", varid) ||

Token::Match(tok, "if ( -1 != %varid% )", varid)) {

addtoken(&rettail, tok, "if(var)");

tok = tok->next()->link();

continue;

} else if (Token::Match(tok, "if ( %varid% == -1 )", varid) ||

Token::Match(tok, "if ( -1 == %varid% )", varid) ||

Token::Match(tok, "if ( %varid% < 0 )", varid) ||

Token::Match(tok, "if ( 0 > %varid% )", varid)) {

addtoken(&rettail, tok, "if(!var)");

tok = tok->next()->link();

continue;

}

}

if (Token::Match(tok, "if ( %varid% )", varid)) {

addtoken(&rettail, tok, "if(var)");

// Make sure the "use" will not be added

tok = tok->next()->link();

continue;

} else if (Token::simpleMatch(tok, "if (") && notvar(tok->tokAt(2), varid, true)) {

addtoken(&rettail, tok, "if(!var)");

// parse the if-body.

// if a variable is assigned then add variable to "extravar".

for (const Token *tok2 = tok->next()->link()->tokAt(2); tok2; tok2 = tok2->next()) {

if (tok2->str() == "{")

tok2 = tok2->link();