[Bug analyzer/106300] New: RFE: analyzer support for more ways of obtaining an open file descriptor

[Bug analyzer/106300] New: RFE: analyzer support for more ways of obtaining an open file descriptor

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106300

            Bug ID: 106300
           Summary: RFE: analyzer support for more ways of obtaining an
                    open file descriptor
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
            Blocks: 106003
  Target Milestone: ---

Currently -fanalyzer special-cases "open" for obtaining a possibly-open file
descriptor (in sm-fd.cc).

We should probably support other ways of obtaining possibly-open file
descriptors, either by special-casing them, or via some new attribute:

creat()
  https://www.man7.org/linux/man-pages/man3/creat.3p.html

pipe() and friends:
  int pipe(int pipefd[2]);
  int pipe2(int pipefd[2], int flags);
  https://www.man7.org/linux/man-pages/man2/pipe.2.html

dup() and friends
  covered in bug 106298

fcntl()
  https://man7.org/linux/man-pages/man2/fcntl.2.html
  (though that's probably a deep rabbit-hole that we may not want to go down)

socket()
  https://www.man7.org/linux/man-pages/man3/socket.3p.html
  See also bug 106140.


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106003
[Bug 106003] RFE: -fanalyzer could complain about misuse of file-descriptors

[Bug analyzer/106300] RFE: analyzer support for more ways of obtaining an open file descriptor

[mir at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106300

Immad Mir <mir at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mir at gcc dot gnu.org

--- Comment #1 from Immad Mir <mir at gcc dot gnu.org> ---
I committed a patch
(https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=6a11f2d974a912aaaedb0ce32cdfde10193003cd)
for the support of creat, dup, dup2 and dup3.

[Bug analyzer/106300] RFE: analyzer support for more ways of obtaining an open file descriptor

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106300

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:792f039fc37faa3446725a643c8018f084e8ccab

commit r13-3466-g792f039fc37faa3446725a643c8018f084e8ccab
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Mon Oct 24 16:38:22 2022 -0400

    analyzer: handle "pipe" and "pipe2" [PR106300]

    gcc/analyzer/ChangeLog:
            PR analyzer/106300
            * engine.cc (impl_region_model_context::get_fd_map): New.
            * exploded-graph.h (impl_region_model_context::get_fd_map): New
            decl.
            * region-model-impl-calls.cc (region_model::impl_call_pipe): New.
            * region-model.cc (region_model::update_for_int_cst_return): New,
            based on...
            (region_model::update_for_zero_return): ...this.  Reimplement in
            terms of the former.
            (region_model::on_call_pre): Handle "pipe" and "pipe2".
            (region_model::on_call_post): Likewise.
            * region-model.h (region_model::impl_call_pipe): New decl.
            (region_model::update_for_int_cst_return): New decl.
            (region_model::mark_as_valid_fd): New decl.
            (region_model_context::get_fd_map): New pure virtual fn.
            (noop_region_model_context::get_fd_map): New.
            (region_model_context_decorator::get_fd_map): New.
            * sm-fd.cc: Include "analyzer/program-state.h".
            (fd_state_machine::describe_state_change): Handle transitions from
            start state to valid states.
            (fd_state_machine::mark_as_valid_fd): New.
            (fd_state_machine::on_stmt): Add missing return for "creat".
            (region_model::mark_as_valid_fd): New.

    gcc/ChangeLog:
            PR analyzer/106300
            * doc/invoke.texi (Static Analyzer Options): Add "pipe" and
            "pipe2" to the list of functions the analyzer has hardcoded
            knowledge of.

    gcc/testsuite/ChangeLog:
            PR analyzer/106300
            * gcc.dg/analyzer/pipe-1.c: New test.
            * gcc.dg/analyzer/pipe-glibc.c: New test.
            * gcc.dg/analyzer/pipe-manpages.c: New test.
            * gcc.dg/analyzer/pipe2-1.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/106300] RFE: analyzer support for more ways of obtaining an open file descriptor

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106300

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
I've implement "pipe" and "pipe2" with the above patch.

"socket" is covered by bug 106140.

I don't intend to tackle "fcntl".

Marking this as resolved.