summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Checkers/CMakeLists.txt
Commit message (Collapse)AuthorAgeFilesLines
* [analyzer][NFC] Move CheckerRegistry from the Core directory to FrontendKristof Umann2018-12-151-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ClangCheckerRegistry is a very non-obvious, poorly documented, weird concept. It derives from CheckerRegistry, and is placed in lib/StaticAnalyzer/Frontend, whereas it's base is located in lib/StaticAnalyzer/Core. It was, from what I can imagine, used to circumvent the problem that the registry functions of the checkers are located in the clangStaticAnalyzerCheckers library, but that library depends on clangStaticAnalyzerCore. However, clangStaticAnalyzerFrontend depends on both of those libraries. One can make the observation however, that CheckerRegistry has no place in Core, it isn't used there at all! The only place where it is used is Frontend, which is where it ultimately belongs. This move implies that since include/clang/StaticAnalyzer/Checkers/ClangCheckers.h only contained a single function: class CheckerRegistry; void registerBuiltinCheckers(CheckerRegistry &registry); it had to re purposed, as CheckerRegistry is no longer available to clangStaticAnalyzerCheckers. It was renamed to BuiltinCheckerRegistration.h, which actually describes it a lot better -- it does not contain the registration functions for checkers, but only those generated by the tblgen files. Differential Revision: https://reviews.llvm.org/D54436 llvm-svn: 349275
* [analyzer] Rename MisusedMovedObjectChecker to MoveCheckerArtem Dergachev2018-12-031-1/+1
| | | | | | | | | This follows the Static Analyzer's tradition to name checkers after things in which they find bugs, not after bugs they find. Differential Revision: https://reviews.llvm.org/D54556 llvm-svn: 348201
* [analyzer] INT50-CPP. Do not cast to an out-of-range enumeration checkerKristof Umann2018-11-241-0/+1
| | | | | | | | | | | | | | | This checker implements a solution to the "INT50-CPP. Do not cast to an out-of-range enumeration value" rule [1]. It lands in alpha for now, and a number of followup patches are planned in order to enable it by default. [1] https://www.securecoding.cert.org/confluence/display/cplusplus/INT50-CPP.+Do+not+cast+to+an+out-of-range+enumeration+value Patch by: Endre Fülöp and Alexander Zaitsev! Differential Revision: https://reviews.llvm.org/D33672 llvm-svn: 347513
* [analyzer][NFC] Fix some incorrect uses of -analyzer-config optionsKristof Umann2018-11-021-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | I'm in the process of refactoring AnalyzerOptions. The main motivation behind here is to emit warnings if an invalid -analyzer-config option is given from the command line, and be able to list them all. In this patch, I found some flags that should've been used as checker options, or have absolutely no mention of in AnalyzerOptions, or are nonexistent. - NonLocalizedStringChecker now uses its "AggressiveReport" flag as a checker option - lib/StaticAnalyzer/Frontend/ModelInjector.cpp now accesses the "model-path" option through a getter in AnalyzerOptions - -analyzer-config path-diagnostics-alternate=false is not a thing, I removed it, - lib/StaticAnalyzer/Checkers/AllocationDiagnostics.cpp and lib/StaticAnalyzer/Checkers/AllocationDiagnostics.h are weird, they actually only contain an option getter. I deleted them, and fixed RetainCountChecker to get it's "leak-diagnostics-reference-allocation" option as a checker option, - "region-store-small-struct-limit" has a proper getter now. Differential Revision: https://reviews.llvm.org/D53276 llvm-svn: 345985
* [analyzer] [NFC] Split up RetainSummaryManager from RetainCountChecker - try #2George Karpenkov2018-08-211-4/+0
| | | | | | | | | | Turns out it can't be removed from the analyzer since it relies on CallEvent. Moving to staticAnalyzer/core Differential Revision: https://reviews.llvm.org/D51023 llvm-svn: 340247
* Revert "[analyzer] [NFC] Split up RetainSummaryManager from RetainCountChecker"Bruno Cardoso Lopes2018-08-181-0/+1
| | | | | | | | | | | | | | This reverts commit a786521fa66c72edd308baff0c08961b6d964fb1. Bots haven't caught up yet, but broke modules build with: ../tools/clang/include/clang/StaticAnalyzer/Checkers/MPIFunctionClassifier.h:18:10: fatal error: cyclic dependency in module 'Clang_StaticAnalyzer_Core': Clang_StaticAnalyzer_Core -> Clang_Analysis -> Clang_StaticAnalyzer_Checkers -> Clang_StaticAnalyzer_Core ^ llvm-svn: 340117
* [analyzer] [NFC] Split up RetainSummaryManager from RetainCountCheckerGeorge Karpenkov2018-08-181-1/+0
| | | | | | | | | | | | | ARCMigrator is using code from RetainCountChecker, which is a layering violation (and it also does it badly, by using a different header, and then relying on implementation being present in a header file). This change splits up RetainSummaryManager into a separate library in lib/Analysis, which can be used independently of a checker. Differential Revision: https://reviews.llvm.org/D50934 llvm-svn: 340114
* [analyzer] [NFC] Split up RetainCountCheckerGeorge Karpenkov2018-08-171-1/+3
| | | | | | | | At some point, staring at 4k+ LOC file becomes a bit hard. Differential Revision: https://reviews.llvm.org/D50821 llvm-svn: 340092
* [analyzer][UninitializedObjectChecker] Refactoring p2.: Moving pointer ↵Kristof Umann2018-08-131-1/+2
| | | | | | | | | | | | | | | | | | | | chasing to a separate file In this patch, the following classes and functions have been moved to a header file: FieldChainInfo FindUninitializedFields isPrimitiveType This also meant that they moved from anonymous namespace to clang::ento. Code related to pointer chasing now relies in its own file. There's absolutely no functional change in this patch -- its literally just copy pasting. Differential Revision: https://reviews.llvm.org/D50504 llvm-svn: 339595
* [analyzer] Syntactic matcher for leaks associated with run loop and ↵George Karpenkov2018-07-251-0/+1
| | | | | | | | | | | | | | | | | | | | | | | autoreleasepool A checker for detecting leaks resulting from allocating temporary autoreleasing objects before starting the main run loop. Checks for two antipatterns: 1. ObjCMessageExpr followed by [[NARunLoop mainRunLoop] run] in the same autorelease pool. 2. ObjCMessageExpr followed by [[NARunLoop mainRunLoop] run] in no autorelease pool. Happens-before relationship is modeled purely syntactically. rdar://39299145 Differential Revision: https://reviews.llvm.org/D49528 llvm-svn: 337876
* [analyzer] Rename DanglingInternalBufferChecker to InnerPointerChecker.Reka Kovacs2018-07-201-1/+1
| | | | | | Differential Revision: https://reviews.llvm.org/D49553 llvm-svn: 337559
* [analyzer] Checker for uninitialized C++ objectsKristof Umann2018-06-181-0/+1
| | | | | | | | | | | | | | | | | | This checker analyzes C++ constructor calls, and reports uninitialized fields. Due to the nature of this problem (uninitialized fields after an object construction), this checker doesn't search for bugs, but rather is a tool to enforce a specific programming model where every field needs to be initialized. This checker lands in alpha for now, and a number of followup patches will be made to reduce false negatives and to make it easier for the user to understand what rules the checker relies on, eg. whether a derived class' constructor is responsible for initializing inherited data members or whether it should be handled in the base class' constructor. Differential Revision: https://reviews.llvm.org/D45532 llvm-svn: 334935
* [analyzer] Add dangling internal buffer check.Reka Kovacs2018-06-091-0/+1
| | | | | | | | | | | | This check will mark raw pointers to C++ standard library container internal buffers 'released' when the objects themselves are destroyed. Such information can be used by MallocChecker to warn about use-after-free problems. In this first version, 'std::basic_string's are supported. Differential Revision: https://reviews.llvm.org/D47135 llvm-svn: 334348
* [analyzer] Path-insensitive checker for writes into an auto-releasing pointerGeorge Karpenkov2018-03-291-0/+1
| | | | | | | | | | from the wrong auto-releasing pool, as such writes may crash. rdar://25301111 Differential Revision: https://reviews.llvm.org/D44722 llvm-svn: 328827
* [analyzer] Trust _Nonnull annotations for system frameworkGeorge Karpenkov2018-03-231-0/+1
| | | | | | | | | | | Changes the analyzer to believe that methods annotated with _Nonnull from system frameworks indeed return non null objects. Local methods with such annotation are still distrusted. rdar://24291919 Differential Revision: https://reviews.llvm.org/D44341 llvm-svn: 328282
* [analyzer] Move the GCDAsyncSemaphoreChecker to optin.performanceGeorge Karpenkov2018-03-121-1/+1
| | | | | | | | rdar://38383753 Differential Revision: https://reviews.llvm.org/D44228 llvm-svn: 327309
* [analyzer] AST-matching checker to detect global central dispatch ↵George Karpenkov2018-03-051-0/+1
| | | | | | | | | | | | | performance anti-pattern rdar://37312818 NB: The checker does not care about the ordering of callbacks, see the relevant FIXME in tests. Differential Revision: https://reviews.llvm.org/D44059 llvm-svn: 326746
* [analyzer] Add a checker for mmap()s which are both writable and executable.Artem Dergachev2018-03-011-0/+1
| | | | | | | | | | | | | | | | | | | This is a security check that warns when both PROT_WRITE and PROT_EXEC are set during mmap(). If mmap()ed memory is both writable and executable, it makes it easier for the attacker to execute arbitrary code when contents of this memory are compromised. Some applications require such mmap()s though, such as different sorts of JIT. Re-applied after a revert in r324167. Temporarily stays in the alpha package because it needs a better way of determining macro values that are not immediately available in the AST. Patch by David Carlier! Differential Revision: https://reviews.llvm.org/D42645 llvm-svn: 326405
* Revert r324166 "[analyzer] Add a checker for mmap()...".Artem Dergachev2018-02-031-1/+0
| | | | | | | | Due to Buildbot failures - most likely that's because target triples were not specified in the tests, even though the checker behaves differently with different target triples. llvm-svn: 324167
* [analyzer] Add a checker for mmap()s which are both writable and executable.Artem Dergachev2018-02-031-0/+1
| | | | | | | | | | | | | | This is a security check which is disabled by default but will be enabled whenever the user consciously enables the security package. If mmap()ed memory is both writable and executable, it makes it easier for the attacker to execute arbitrary code when contents of this memory are compromised. Some applications require such mmap()s though, such as different sorts of JIT. Patch by David Carlier! Differential Revision: https://reviews.llvm.org/D42645 llvm-svn: 324166
* [Analyzer] Assume that CFBooleanRef const globals are non-nullGeorge Karpenkov2017-10-131-1/+1
| | | | | | Differential Revision: https://reviews.llvm.org/D38867 llvm-svn: 315655
* [Analyzer] Assume that string-like const globals are non-nil.George Karpenkov2017-10-111-0/+1
| | | | | | Differential Revision: https://reviews.llvm.org/D38764 llvm-svn: 315488
* [analyzer] Add new delete with non-virtual destructor checkGabor Horvath2017-09-221-0/+1
| | | | | | | | Patch by: Reka Nikolett Kovacs Differential Revision: https://reviews.llvm.org/D35796 llvm-svn: 313973
* [analyzer] Initial commit for the upcoming refactoring of the IteratorChecker.Artem Dergachev2017-05-291-1/+1
| | | | | | | | | | | | | | | The new checker currently contains the very core infrastructure for tracking the state of iterator-type objects in the analyzer: relating iterators to their containers, tracking symbolic begin and end iterator values for containers, and solving simple equality-type constraints over iterators. A single specific check over this infrastructure is capable of finding usage of out-of-range iterators in some simple cases. Patch by Ádám Balogh! Differential revision: https://reviews.llvm.org/D32592 llvm-svn: 304160
* [analyzer] Add MisusedMovedObjectChecker for detecting use-after-move errors.Artem Dergachev2017-03-241-0/+1
| | | | | | | | | | | | The checker currently warns on copying, moving, or calling methods on an object that was recently std::move'd from. It understands a set of "state reset" methods that bring a moved-from object back to a well-specified state. Patch by Peter Szecsi! Differential Revision: https://reviews.llvm.org/D24246 llvm-svn: 298698
* [analyzer] Add checker for iterators dereferenced beyond their range.Gabor Horvath2017-01-091-0/+1
| | | | | | | | Patch by: Adam Balogh! Differential Revision: https://reviews.llvm.org/D25660 llvm-svn: 291430
* [analyzer] Add checker modeling gtest APIs.Devin Coughlin2016-12-191-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | gtest is a widely-used unit-testing API. It provides macros for unit test assertions: ASSERT_TRUE(p != nullptr); that expand into an if statement that constructs an object representing the result of the assertion and returns when the assertion is false: if (AssertionResult gtest_ar_ = AssertionResult(p == nullptr)) ; else return ...; Unfortunately, the analyzer does not model the effect of the constructor precisely because (1) the copy constructor implementation is missing from the the header (so it can't be inlined) and (2) the boolean-argument constructor is constructed into a temporary (so the analyzer decides not to inline it since it doesn't reliably call temporary destructors right now). This results in false positives because the analyzer does not realize that the the assertion must hold along the non-return path. This commit addresses the false positives by explicitly modeling the effects of the two un-inlined constructors on the AssertionResult state. I've added a new package, "apiModeling", for these kinds of checkers that model APIs but don't emit any diagnostics. I envision all the checkers in this package always being on by default. This addresses the false positives reported in PR30936. Differential Revision: https://reviews.llvm.org/D27773 rdar://problem/22705813 llvm-svn: 290143
* [analyzer] Detect ObjC properties that are both (copy) and Mutable.Artem Dergachev2016-12-131-0/+1
| | | | | | | | | | | | | | | When an Objective-C property has a (copy) attribute, the default setter for this property performs a -copy on the object assigned. Calling -copy on a mutable NS object such as NSMutableString etc. produces an immutable object, NSString in our example. Hence the getter becomes type-incorrect. rdar://problem/21022397 Differential Revision: https://reviews.llvm.org/D27535 llvm-svn: 289554
* [analyzer] Add StdLibraryFunctions checker.Artem Dergachev2016-10-241-0/+1
| | | | | | | | | | | | | | | This checker does not emit reports, however it influences the analysis by providing complete summaries for, or otherwise improving modeling of, various standard library functions. This should reduce the number of infeasible paths explored during analysis. The custom function summary format used in this checker is superior to body farms by causing less unnecessary state splits, which would result in better analysis performance. Differential Revision: https://reviews.llvm.org/D20811 llvm-svn: 284960
* [analyzer] Add NumberObjectConversion checker.Artem Dergachev2016-10-181-0/+1
| | | | | | | | | | | | | | | | | When dealing with objects that represent numbers, such as Objective-C NSNumber, the language provides little protection from accidentally interpreting the value of a pointer to such object as the value of the number represented by the object. Results of such mis-interpretation may be unexpected. The checker attempts to fill this gap in cases when the code is obviously incorrect. With "Pedantic" option enabled, this checker enforces a coding style to completely prevent errors of this kind (off by default). Differential Revision: https://reviews.llvm.org/D22968 llvm-svn: 284473
* [analyzer] Link libStaticAnalyzerCheckers to libASTMatchers.Artem Dergachev2016-10-131-0/+1
| | | | | | | | | | | | | AST matchers are useful for the analyzer's checkers. More patches on particular checkers shall follow. This is the first time clang binary gets linked to ASTMatchers. The binary size increase for the clang executable would be +0.5% in release mode, +2% in debug mode. Differential Revision: https://reviews.llvm.org/D25429 llvm-svn: 284112
* [analyzer] Add a checker that detects blocks in critical sectionsAnna Zaks2016-09-201-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | This checker should find the calls to blocking functions (for example: sleep, getc, fgets,read,recv etc.) inside a critical section. When sleep(x) is called while a mutex is held, other threads cannot lock the same mutex. This might take some time, leading to bad performance or even deadlock. Example: mutex_t m; void f() { sleep(1000); // Error: sleep() while m is locked! [f() is called from foobar() while m is locked] // do some work } void foobar() { lock(m); f(); unlock(m); } A patch by zdtorok (Zoltán Dániel Török)! Differential Revision: https://reviews.llvm.org/D21506 llvm-svn: 282011
* [analyzer] ExprEngine: remove second call to PreStmt<CastExpr>Aleksei Sidorin2016-09-011-0/+1
| | | | | | | | | This patch also introduces AnalysisOrderChecker which is intended for testing of callback call correctness. Differential Revision: https://reviews.llvm.org/D23804 llvm-svn: 280367
* Reapply "[analyzer] Added valist related checkers."Gabor Horvath2016-08-221-0/+1
| | | | | | Differential Revision: https://reviews.llvm.org/D15227 llvm-svn: 279427
* revert [analyzer] Added valist related checkers.Gabor Horvath2016-08-181-1/+0
| | | | llvm-svn: 279043
* [analyzer] Added valist related checkers.Gabor Horvath2016-08-181-0/+1
| | | | | | Differential Revision: https://reviews.llvm.org/D15227 llvm-svn: 279041
* [analyzer] Add a checker for loss of sign or precision in integral casts.Artem Dergachev2016-08-171-0/+1
| | | | | | | | | | | | | | | This new checker tries to find execution paths on which implicit integral casts cause definite loss of information: a certainly-negative integer is converted to an unsigned integer, or an integer is definitely truncated to fit into a smaller type. Being implicit, such casts are likely to produce unexpected results. Patch by Daniel Marjamäki! Differential Revision: https://reviews.llvm.org/D13126 llvm-svn: 278941
* [analyzer] Add basic capabilities to detect source code clones.Artem Dergachev2016-07-261-0/+1
| | | | | | | | | | | | | | | | | | | | | This patch adds the CloneDetector class which allows searching source code for clones. For every statement or group of statements within a compound statement, CloneDetector computes a hash value, and finds clones by detecting identical hash values. This initial patch only provides a simple hashing mechanism that hashes the kind of each sub-statement. This patch also adds CloneChecker - a simple static analyzer checker that uses CloneDetector to report copy-pasted code. Patch by Raphael Isemann! Differential Revision: https://reviews.llvm.org/D20795 llvm-svn: 276782
* [analyzer] Add checker modeling potential C++ self-assignmentDevin Coughlin2016-07-211-0/+1
| | | | | | | | | | | | | | | | | | | | | This checker checks copy and move assignment operators whether they are protected against self-assignment. Since C++ core guidelines discourages explicit checking for `&rhs==this` in general we take a different approach: in top-frame analysis we branch the exploded graph for two cases, where &rhs==this and &rhs!=this and let existing checkers (e.g. unix.Malloc) do the rest of the work. It is important that we check all copy and move assignment operator in top frame even if we checked them already since self-assignments may happen undetected even in the same translation unit (e.g. using random indices for an array what may or may not be the same). This reapplies r275820 after fixing a string-lifetime issue discovered by the bots. A patch by Ádám Balogh! Differential Revision: https://reviews.llvm.org/D19311 llvm-svn: 276365
* Revert "[analyzer] Add checker modeling potential C++ self-assignment"Devin Coughlin2016-07-181-1/+0
| | | | | | This reverts commit r275820. It is failing on the bots. llvm-svn: 275880
* [analyzer] Add checker modeling potential C++ self-assignmentDevin Coughlin2016-07-181-0/+1
| | | | | | | | | | | | | | | | | | This checker checks copy and move assignment operators whether they are protected against self-assignment. Since C++ core guidelines discourages explicit checking for `&rhs==this` in general we take a different approach: in top-frame analysis we branch the exploded graph for two cases, where &rhs==this and &rhs!=this and let existing checkers (e.g. unix.Malloc) do the rest of the work. It is important that we check all copy and move assignment operator in top frame even if we checked them already since self-assignments may happen undetected even in the same translation unit (e.g. using random indices for an array what may or may not be the same). A patch by Ádám Balogh! Differential Revision: https://reviews.llvm.org/D19311 llvm-svn: 275820
* [analyzer] Add checker to verify the correct usage of the MPI APIDevin Coughlin2016-06-131-0/+3
| | | | | | | | | | | | | | | | | | | | | This commit adds a static analysis checker to verify the correct usage of the MPI API in C and C++. This version updates the reverted r271981 to fix a memory corruption found by the ASan bots. Three path-sensitive checks are included: - Double nonblocking: Double request usage by nonblocking calls without intermediate wait - Missing wait: Nonblocking call without matching wait. - Unmatched wait: Waiting for a request that was never used by a nonblocking call Examples of how to use the checker can be found at https://github.com/0ax1/MPI-Checker A patch by Alexander Droste! Reviewers: zaks.anna, dcoughlin Differential Revision: http://reviews.llvm.org/D21081 llvm-svn: 272529
* Revert "[analyzer] Reapply r271907 (2nd try)."Devin Coughlin2016-06-071-3/+0
| | | | | | | | Even with the fix in r271981, ASan is finding a stack use after return. This reverts commits r271977 and r271981. llvm-svn: 271984
* [analyzer] Reapply r271907 (2nd try).Devin Coughlin2016-06-071-0/+3
| | | | | | | | | | | | | | Second try at reapplying "[analyzer] Add checker for correct usage of MPI API in C and C++." Special thanks to Dan Liew for helping test the fix for the template specialization compiler error with gcc. The original patch is by Alexander Droste! Differential Revision: http://reviews.llvm.org/D12761 llvm-svn: 271977
* Revert "Reapply "[analyzer] Add checker for correct usage of MPI API in C ↵Devin Coughlin2016-06-061-3/+0
| | | | | | | | and C++."" This reverts commit r271914. It is still breaking bots. llvm-svn: 271920
* Reapply "[analyzer] Add checker for correct usage of MPI API in C and C++."Devin Coughlin2016-06-061-0/+3
| | | | | | | | | Reapply r271907 with a fix for the compiler error with gcc about specializing clang::ento::ProgramStateTrait in a different namespace. Differential Revision: http://reviews.llvm.org/D12761 llvm-svn: 271914
* Revert "[analyzer] Add checker for correct usage of MPI API in C and C++."Devin Coughlin2016-06-061-3/+0
| | | | | | | This reverts commit r271907. It broke a bunch of bots with compile errors about specializations in different namespaces. llvm-svn: 271909
* [analyzer] Add checker for correct usage of MPI API in C and C++.Devin Coughlin2016-06-061-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | This commit adds a static analysis checker to check for the correct usage of the MPI API in C and C++. 3 path-sensitive checks are included: - Double nonblocking: Double request usage by nonblocking calls without intermediate wait. - Missing wait: Nonblocking call without matching wait. - Unmatched wait: Waiting for a request that was never used by a nonblocking call. Examples of how to use the checker can be found at https://github.com/0ax1/MPI-Checker Reviewers: zaks.anna A patch by Alexander Droste! Differential Revision: http://reviews.llvm.org/D12761 llvm-svn: 271907
* [analyzer] Move Checkers.inc to clang/include/...Chih-Hung Hsieh2016-04-281-5/+0
| | | | | | | | Simplify sharing of Checkers.inc with other files like ClangTidy.cpp. Differential Revision: http://reviews.llvm.org/19393 llvm-svn: 267832
* [analyzer] Detect duplicate [super dealloc] callsDevin Coughlin2016-02-221-0/+1
| | | | | | | | | | | | | | Add an alpha path checker that warns about duplicate calls to [super dealloc]. This will form the foundation of a checker that will detect uses of 'self' after calling [super dealloc]. Part of rdar://problem/6953275. Based on a patch by David Kilzer! Differential Revision: http://reviews.llvm.org/D5238 llvm-svn: 261545
OpenPOWER on IntegriCloud