Does Coverity support Interprocedural-Analysis - coverity

Question

Program execute result:
zsh: segmentation fault ./test.out
Coverity analyse output:
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
// uaf
void test_1(void *p) {
free(p);
CID 358676: Read from pointer after free (USE_AFTER_FREE) [select issue]
printf("%x\n", *((int *)p));
}
// loop write
void test_2(int total, char *p) {
char a[100];
for(int i=0;i < total; i++) {
a[i] = *(p + i);
}
}
typedef struct {
char name[100];
}Person;
// uint8 *p
void test_3(Person *p) {
unsigned char *ptr = (unsigned char *)p;
for(int i=0; i < sizeof(Person) + 100; i++) {
*ptr = 'a';
}
free(p);
CID 358686: Read from pointer after free (USE_AFTER_FREE) [select issue]
printf("%x\n", *((int *)p));
}
// state machine
enum {
S_START,
S_IDLE,
S_BUSY,
S_UNKNOWN
};
int gState = S_START;
void *gPtr = NULL;
void handle_start() {
int size;
printf("input malloc size:\n");
CID 358721: Unchecked return value from library (CHECKED_RETURN) [select issue]
scanf("%d", &size);
CID 134591: Untrusted allocation size (TAINTED_SCALAR) [select issue]
gPtr = malloc(size);
gState = S_BUSY;
printf("S_START -> S_BUSY\n");
}
void handle_busy() {
char buff[100];
printf("input string:\n");
CID 358720: Unchecked return value from library (CHECKED_RETURN) [select issue]
CID 358719: Calling risky function (DC.STREAM_BUFFER) [select issue]
scanf("%s", buff);
strcpy(gPtr, buff);
puts(gPtr);
gState = S_IDLE;
printf("S_BUSY -> S_IDLE\n");
}
void handle_idle(void *p) {
char cmd;
printf("continue or exit(C/E)?");
CID 358718: Unchecked return value from library (CHECKED_RETURN) [select issue]
scanf("%c", &cmd);
if (cmd == 'c' || cmd == 'C') {
gState = S_BUSY;
printf("S_IDLE -> S_BUSY\n");
} else {
free(p);
printf("S_IDLE -> S_START\n");
printf("exit\n");
exit(0);
}
}
void process(void *p) {
switch (gState) {
case S_START:
handle_idle(p);
handle_start();
break;
case S_BUSY:
handle_busy();
break;
case S_IDLE:
handle_idle(p);
break;
default:
break;
}
}
void test_4(void *p) {
while (1)
{
process(p);
}
}
void test_5(void *pData) {
int kind = 0;
void *ptr = NULL;
printf("input kind:\n");
CID 358724: Unchecked return value from library (CHECKED_RETURN) [select issue]
scanf("%d", &kind);
1. Switch case default.
switch (kind) {
case 1:
ptr = malloc(100);
break;
case 2:
ptr = malloc(200);
break;
default:
2. alloc_fn: Storage is returned from allocation function malloc.
3. var_assign: Assigning: ptr = storage returned from malloc(64UL).
ptr = malloc(64);
4. Breaking from switch.
break;
}
5. Switch case default.
switch(kind) {
case 1:
memcpy(ptr, pData, 1000);
break;
case 2:
memcpy(ptr, pData, 2000);
break;
default:
6. noescape: Resource ptr is not freed or pointed-to in memcpy.
memcpy(ptr, pData, 64);
7. Breaking from switch.
break;
}
8. noescape: Resource (char *)ptr is not freed or pointed-to in printf.
printf("result: %s\n", (char *)ptr);
CID 358723 (#1-3 of 3): Resource leak (RESOURCE_LEAK)
9. leaked_storage: Variable ptr going out of scope leaks the storage it points to.
}
void test_6_sub(void *p) {
if (p == NULL) {
return;
}
free(p);
}
void test_6(void *p) {
test_6_sub(p);
}
int *n() {
return 0;
}
int main(void)
{
// int a;
// printf("input copy length: ");
// scanf("%d",&a);
// printf("copy %d bytes\n",a);
// void *p = malloc(100);
// memcpy(p, (char *)&a, a);
// printf("%s", (char *)&a);
gPtr = malloc(100);
char *p = gPtr;
free(gPtr);
char *name = "adfsasdfasdfasdfasdfasdf";
// test_4(p);
// test_6(p);
return *(n());
}
After analyse by coverity, I just do not get the vulnerability infomation what I want.
According to the introduction of Coverity
should be find the free of Null pointer vulnerability.
should be find the dead code
should be find the function call chains
But I got nothing
Is something wrong?
I got this test result at https://scan.coverity.com
Is the online service has some restrict?

Answer 1

The answer to the question in the title, "Does Coverity support Interprocedural-Analysis", is yes. The Coverity analysis indeed examines how functions call one another in an attempt to discover inconsistencies.
However, there are limitations to the precision of that interprocedural analysis. In particular, although it tries to keep track of relationships involving (at least) parameters, return values, and things pointed to by those, in most cases it cannot track relationships between global variables across function calls. (The reason for that is there are simply too many such variables and too many potential relationships, so trying to track them all would result in the analysis never terminating.)
In your example, there is an intended invariant that gPtr is a valid pointer if and only if gState == S_IDLE. Consequently, the handle_idle() function can only be called when gState == S_IDLE. The process() function violates that requirement by calling handle_idle() while gState == S_START, which (based on the clarification in the comments) is the bug you want to find. That deduction is unfortunately beyond the capabilities of the tool, so it does not report it.