summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Checkers/CMakeLists.txt
Commit message (Collapse)AuthorAgeFilesLines
* [analyzer] Add PlacementNewCheckerGabor Marton2020-01-101-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Summary: This checker verifies if default placement new is provided with pointers to sufficient storage capacity. Noncompliant Code Example: #include <new> void f() { short s; long *lp = ::new (&s) long; } Based on SEI CERT rule MEM54-CPP https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM54-CPP.+Provide+placement+new+with+properly+aligned+pointe This patch does not implement checking of the alignment. Reviewers: NoQ, xazax.hun Subscribers: mgorny, whisperity, xazax.hun, baloghadamsoftware, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat Tags: #clang Differential Revision: https://reviews.llvm.org/D71612
* [analyzer] Add Fuchsia Handle checkerGabor Horvath2019-12-201-0/+1
| | | | | | | The checker can diagnose handle use after releases, double releases, and handle leaks. Differential Revision: https://reviews.llvm.org/D70470
* [Analyzer][NFC] Iterator Checkers - Separate iterator modeling and the ↵Adam Balogh2019-12-111-1/+6
| | | | | | | | | | actual checkers A monolithic checker class is hard to maintain. This patch splits it up into a modeling part, the three checkers and a debug checker. The common functions are moved into a library. Differential Revision: https://reviews.llvm.org/D70320
* [analyzer] CastValueChecker: Model castsCsaba Dabis2019-07-101-0/+1
| | | | | | | | | | | | | | | | | | | | | Summary: It models the LLVM casts: - `cast<>` - `dyn_cast<>` - `cast_or_null<>` - `dyn_cast_or_null<>` It has a very basic support without checking the `classof()` function. (It reapplies the reverted 'llvm-svn: 365582' patch with proper test file.) Reviewed By: NoQ Tags: #clang Differential Revision: https://reviews.llvm.org/D64374 llvm-svn: 365585
* Revert "[analyzer] CastValueChecker: Model casts"Csaba Dabis2019-07-091-1/+0
| | | | | | This reverts commit 27cf6664437efd640bb6db5594bafcce68fa2854. llvm-svn: 365584
* [analyzer] CastValueChecker: Model castsCsaba Dabis2019-07-091-0/+1
| | | | | | | | | | | | | | | | | | | Summary: It models the LLVM casts: - `cast<>` - `dyn_cast<>` - `cast_or_null<>` - `dyn_cast_or_null<>` It has a very basic support without checking the `classof()` function. Reviewed By: NoQ Tags: #clang Differential Revision: https://reviews.llvm.org/D64374 llvm-svn: 365582
* [analyzer] ReturnValueChecker: Model the guaranteed boolean return value of ↵Csaba Dabis2019-07-041-0/+1
| | | | | | | | | | | | | | | | | | | function calls Summary: It models the known LLVM methods paired with their class. Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus Reviewed By: NoQ Subscribers: dschuff, aheejin, mgorny, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D63915 llvm-svn: 365103
* [Analyzer] Checker for non-determinism caused by iteration of unordered ↵Mandeep Singh Grang2019-05-241-0/+1
| | | | | | | | | | | | | | | | | | container of pointers Summary: Added a checker for non-determinism caused by iterating unordered containers like std::unordered_set containing pointer elements. Reviewers: NoQ, george.karpenkov, whisperity, Szelethus, baloghadamsoftware Reviewed By: Szelethus Subscribers: mgorny, xazax.hun, baloghadamsoftware, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, jdoerfert, Charusso, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D59279 llvm-svn: 361664
* [analyzer] PR41269: Add a bit of C++ smart pointer modeling.Artem Dergachev2019-04-231-0/+1
| | | | | | | | | | | | | Implement cplusplus.SmartPtrModeling, a new checker that doesn't emit any warnings but models methods of smart pointers more precisely. For now the only thing it does is make `(bool) P` return false when `P` is a freshly moved pointer. This addresses a false positive in the use-after-move-checker. Differential Revision: https://reviews.llvm.org/D60796 llvm-svn: 358944
* [analyzer] Move taint API from ProgramState to a separate header. NFC.Artem Dergachev2019-03-291-0/+1
| | | | | | | | | | It is now an inter-checker communication API, similar to the one that connects MallocChecker/CStringChecker/InnerPointerChecker: simply a set of setters and getters for a state trait. Differential Revision: https://reviews.llvm.org/D59861 llvm-svn: 357326
* [Analyzer] Checker for non-determinism caused by sorting of pointer-like ↵Mandeep Singh Grang2019-03-081-0/+1
| | | | | | | | | | | | | | | | | | | | elements Summary: Added a new category of checkers for non-determinism. Added a checker for non-determinism caused due to sorting containers with pointer-like elements. Reviewers: NoQ, george.karpenkov, whisperity, Szelethus Reviewed By: NoQ, Szelethus Subscribers: Charusso, baloghadamsoftware, jdoerfert, donat.nagy, dkrupp, martong, dblaikie, MTC, Szelethus, mgorny, xazax.hun, szepet, rnkovacs, a.sidorin, mikhail.ramalho, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D50488 llvm-svn: 355720
* [analyzer] MIGChecker: A checker for Mach Interface Generator conventions.Artem Dergachev2019-02-211-0/+1
| | | | | | | | | | | | | | | | | This checker detects use-after-free bugs in (various forks of) the Mach kernel that are caused by errors in MIG server routines - functions called remotely by MIG clients. The MIG convention forces the server to only deallocate objects it receives from the client when the routine is executed successfully. Otherwise, if the server routine exits with an error, the client assumes that it needs to deallocate the out-of-line data it passed to the server manually. This means that deallocating such data within the MIG routine and then returning a non-zero error code is always a dangerous use-after-free bug. rdar://problem/35380337 Differential Revision: https://reviews.llvm.org/D57558 llvm-svn: 354635
* [analyzer] Opt-in C Style Cast Checker for OSObject pointersGeorge Karpenkov2019-02-081-0/+1
| | | | | | Differential Revision: https://reviews.llvm.org/D57261 llvm-svn: 353566
* [analyzer][NFC] Move CheckerRegistry from the Core directory to FrontendKristof Umann2018-12-151-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ClangCheckerRegistry is a very non-obvious, poorly documented, weird concept. It derives from CheckerRegistry, and is placed in lib/StaticAnalyzer/Frontend, whereas it's base is located in lib/StaticAnalyzer/Core. It was, from what I can imagine, used to circumvent the problem that the registry functions of the checkers are located in the clangStaticAnalyzerCheckers library, but that library depends on clangStaticAnalyzerCore. However, clangStaticAnalyzerFrontend depends on both of those libraries. One can make the observation however, that CheckerRegistry has no place in Core, it isn't used there at all! The only place where it is used is Frontend, which is where it ultimately belongs. This move implies that since include/clang/StaticAnalyzer/Checkers/ClangCheckers.h only contained a single function: class CheckerRegistry; void registerBuiltinCheckers(CheckerRegistry &registry); it had to re purposed, as CheckerRegistry is no longer available to clangStaticAnalyzerCheckers. It was renamed to BuiltinCheckerRegistration.h, which actually describes it a lot better -- it does not contain the registration functions for checkers, but only those generated by the tblgen files. Differential Revision: https://reviews.llvm.org/D54436 llvm-svn: 349275
* [analyzer] Rename MisusedMovedObjectChecker to MoveCheckerArtem Dergachev2018-12-031-1/+1
| | | | | | | | | This follows the Static Analyzer's tradition to name checkers after things in which they find bugs, not after bugs they find. Differential Revision: https://reviews.llvm.org/D54556 llvm-svn: 348201
* [analyzer] INT50-CPP. Do not cast to an out-of-range enumeration checkerKristof Umann2018-11-241-0/+1
| | | | | | | | | | | | | | | This checker implements a solution to the "INT50-CPP. Do not cast to an out-of-range enumeration value" rule [1]. It lands in alpha for now, and a number of followup patches are planned in order to enable it by default. [1] https://www.securecoding.cert.org/confluence/display/cplusplus/INT50-CPP.+Do+not+cast+to+an+out-of-range+enumeration+value Patch by: Endre Fülöp and Alexander Zaitsev! Differential Revision: https://reviews.llvm.org/D33672 llvm-svn: 347513
* [analyzer][NFC] Fix some incorrect uses of -analyzer-config optionsKristof Umann2018-11-021-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | I'm in the process of refactoring AnalyzerOptions. The main motivation behind here is to emit warnings if an invalid -analyzer-config option is given from the command line, and be able to list them all. In this patch, I found some flags that should've been used as checker options, or have absolutely no mention of in AnalyzerOptions, or are nonexistent. - NonLocalizedStringChecker now uses its "AggressiveReport" flag as a checker option - lib/StaticAnalyzer/Frontend/ModelInjector.cpp now accesses the "model-path" option through a getter in AnalyzerOptions - -analyzer-config path-diagnostics-alternate=false is not a thing, I removed it, - lib/StaticAnalyzer/Checkers/AllocationDiagnostics.cpp and lib/StaticAnalyzer/Checkers/AllocationDiagnostics.h are weird, they actually only contain an option getter. I deleted them, and fixed RetainCountChecker to get it's "leak-diagnostics-reference-allocation" option as a checker option, - "region-store-small-struct-limit" has a proper getter now. Differential Revision: https://reviews.llvm.org/D53276 llvm-svn: 345985
* [analyzer] [NFC] Split up RetainSummaryManager from RetainCountChecker - try #2George Karpenkov2018-08-211-4/+0
| | | | | | | | | | Turns out it can't be removed from the analyzer since it relies on CallEvent. Moving to staticAnalyzer/core Differential Revision: https://reviews.llvm.org/D51023 llvm-svn: 340247
* Revert "[analyzer] [NFC] Split up RetainSummaryManager from RetainCountChecker"Bruno Cardoso Lopes2018-08-181-0/+1
| | | | | | | | | | | | | | This reverts commit a786521fa66c72edd308baff0c08961b6d964fb1. Bots haven't caught up yet, but broke modules build with: ../tools/clang/include/clang/StaticAnalyzer/Checkers/MPIFunctionClassifier.h:18:10: fatal error: cyclic dependency in module 'Clang_StaticAnalyzer_Core': Clang_StaticAnalyzer_Core -> Clang_Analysis -> Clang_StaticAnalyzer_Checkers -> Clang_StaticAnalyzer_Core ^ llvm-svn: 340117
* [analyzer] [NFC] Split up RetainSummaryManager from RetainCountCheckerGeorge Karpenkov2018-08-181-1/+0
| | | | | | | | | | | | | ARCMigrator is using code from RetainCountChecker, which is a layering violation (and it also does it badly, by using a different header, and then relying on implementation being present in a header file). This change splits up RetainSummaryManager into a separate library in lib/Analysis, which can be used independently of a checker. Differential Revision: https://reviews.llvm.org/D50934 llvm-svn: 340114
* [analyzer] [NFC] Split up RetainCountCheckerGeorge Karpenkov2018-08-171-1/+3
| | | | | | | | At some point, staring at 4k+ LOC file becomes a bit hard. Differential Revision: https://reviews.llvm.org/D50821 llvm-svn: 340092
* [analyzer][UninitializedObjectChecker] Refactoring p2.: Moving pointer ↵Kristof Umann2018-08-131-1/+2
| | | | | | | | | | | | | | | | | | | | chasing to a separate file In this patch, the following classes and functions have been moved to a header file: FieldChainInfo FindUninitializedFields isPrimitiveType This also meant that they moved from anonymous namespace to clang::ento. Code related to pointer chasing now relies in its own file. There's absolutely no functional change in this patch -- its literally just copy pasting. Differential Revision: https://reviews.llvm.org/D50504 llvm-svn: 339595
* [analyzer] Syntactic matcher for leaks associated with run loop and ↵George Karpenkov2018-07-251-0/+1
| | | | | | | | | | | | | | | | | | | | | | | autoreleasepool A checker for detecting leaks resulting from allocating temporary autoreleasing objects before starting the main run loop. Checks for two antipatterns: 1. ObjCMessageExpr followed by [[NARunLoop mainRunLoop] run] in the same autorelease pool. 2. ObjCMessageExpr followed by [[NARunLoop mainRunLoop] run] in no autorelease pool. Happens-before relationship is modeled purely syntactically. rdar://39299145 Differential Revision: https://reviews.llvm.org/D49528 llvm-svn: 337876
* [analyzer] Rename DanglingInternalBufferChecker to InnerPointerChecker.Reka Kovacs2018-07-201-1/+1
| | | | | | Differential Revision: https://reviews.llvm.org/D49553 llvm-svn: 337559
* [analyzer] Checker for uninitialized C++ objectsKristof Umann2018-06-181-0/+1
| | | | | | | | | | | | | | | | | | This checker analyzes C++ constructor calls, and reports uninitialized fields. Due to the nature of this problem (uninitialized fields after an object construction), this checker doesn't search for bugs, but rather is a tool to enforce a specific programming model where every field needs to be initialized. This checker lands in alpha for now, and a number of followup patches will be made to reduce false negatives and to make it easier for the user to understand what rules the checker relies on, eg. whether a derived class' constructor is responsible for initializing inherited data members or whether it should be handled in the base class' constructor. Differential Revision: https://reviews.llvm.org/D45532 llvm-svn: 334935
* [analyzer] Add dangling internal buffer check.Reka Kovacs2018-06-091-0/+1
| | | | | | | | | | | | This check will mark raw pointers to C++ standard library container internal buffers 'released' when the objects themselves are destroyed. Such information can be used by MallocChecker to warn about use-after-free problems. In this first version, 'std::basic_string's are supported. Differential Revision: https://reviews.llvm.org/D47135 llvm-svn: 334348
* [analyzer] Path-insensitive checker for writes into an auto-releasing pointerGeorge Karpenkov2018-03-291-0/+1
| | | | | | | | | | from the wrong auto-releasing pool, as such writes may crash. rdar://25301111 Differential Revision: https://reviews.llvm.org/D44722 llvm-svn: 328827
* [analyzer] Trust _Nonnull annotations for system frameworkGeorge Karpenkov2018-03-231-0/+1
| | | | | | | | | | | Changes the analyzer to believe that methods annotated with _Nonnull from system frameworks indeed return non null objects. Local methods with such annotation are still distrusted. rdar://24291919 Differential Revision: https://reviews.llvm.org/D44341 llvm-svn: 328282
* [analyzer] Move the GCDAsyncSemaphoreChecker to optin.performanceGeorge Karpenkov2018-03-121-1/+1
| | | | | | | | rdar://38383753 Differential Revision: https://reviews.llvm.org/D44228 llvm-svn: 327309
* [analyzer] AST-matching checker to detect global central dispatch ↵George Karpenkov2018-03-051-0/+1
| | | | | | | | | | | | | performance anti-pattern rdar://37312818 NB: The checker does not care about the ordering of callbacks, see the relevant FIXME in tests. Differential Revision: https://reviews.llvm.org/D44059 llvm-svn: 326746
* [analyzer] Add a checker for mmap()s which are both writable and executable.Artem Dergachev2018-03-011-0/+1
| | | | | | | | | | | | | | | | | | | This is a security check that warns when both PROT_WRITE and PROT_EXEC are set during mmap(). If mmap()ed memory is both writable and executable, it makes it easier for the attacker to execute arbitrary code when contents of this memory are compromised. Some applications require such mmap()s though, such as different sorts of JIT. Re-applied after a revert in r324167. Temporarily stays in the alpha package because it needs a better way of determining macro values that are not immediately available in the AST. Patch by David Carlier! Differential Revision: https://reviews.llvm.org/D42645 llvm-svn: 326405
* Revert r324166 "[analyzer] Add a checker for mmap()...".Artem Dergachev2018-02-031-1/+0
| | | | | | | | Due to Buildbot failures - most likely that's because target triples were not specified in the tests, even though the checker behaves differently with different target triples. llvm-svn: 324167
* [analyzer] Add a checker for mmap()s which are both writable and executable.Artem Dergachev2018-02-031-0/+1
| | | | | | | | | | | | | | This is a security check which is disabled by default but will be enabled whenever the user consciously enables the security package. If mmap()ed memory is both writable and executable, it makes it easier for the attacker to execute arbitrary code when contents of this memory are compromised. Some applications require such mmap()s though, such as different sorts of JIT. Patch by David Carlier! Differential Revision: https://reviews.llvm.org/D42645 llvm-svn: 324166
* [Analyzer] Assume that CFBooleanRef const globals are non-nullGeorge Karpenkov2017-10-131-1/+1
| | | | | | Differential Revision: https://reviews.llvm.org/D38867 llvm-svn: 315655
* [Analyzer] Assume that string-like const globals are non-nil.George Karpenkov2017-10-111-0/+1
| | | | | | Differential Revision: https://reviews.llvm.org/D38764 llvm-svn: 315488
* [analyzer] Add new delete with non-virtual destructor checkGabor Horvath2017-09-221-0/+1
| | | | | | | | Patch by: Reka Nikolett Kovacs Differential Revision: https://reviews.llvm.org/D35796 llvm-svn: 313973
* [analyzer] Initial commit for the upcoming refactoring of the IteratorChecker.Artem Dergachev2017-05-291-1/+1
| | | | | | | | | | | | | | | The new checker currently contains the very core infrastructure for tracking the state of iterator-type objects in the analyzer: relating iterators to their containers, tracking symbolic begin and end iterator values for containers, and solving simple equality-type constraints over iterators. A single specific check over this infrastructure is capable of finding usage of out-of-range iterators in some simple cases. Patch by Ádám Balogh! Differential revision: https://reviews.llvm.org/D32592 llvm-svn: 304160
* [analyzer] Add MisusedMovedObjectChecker for detecting use-after-move errors.Artem Dergachev2017-03-241-0/+1
| | | | | | | | | | | | The checker currently warns on copying, moving, or calling methods on an object that was recently std::move'd from. It understands a set of "state reset" methods that bring a moved-from object back to a well-specified state. Patch by Peter Szecsi! Differential Revision: https://reviews.llvm.org/D24246 llvm-svn: 298698
* [analyzer] Add checker for iterators dereferenced beyond their range.Gabor Horvath2017-01-091-0/+1
| | | | | | | | Patch by: Adam Balogh! Differential Revision: https://reviews.llvm.org/D25660 llvm-svn: 291430
* [analyzer] Add checker modeling gtest APIs.Devin Coughlin2016-12-191-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | gtest is a widely-used unit-testing API. It provides macros for unit test assertions: ASSERT_TRUE(p != nullptr); that expand into an if statement that constructs an object representing the result of the assertion and returns when the assertion is false: if (AssertionResult gtest_ar_ = AssertionResult(p == nullptr)) ; else return ...; Unfortunately, the analyzer does not model the effect of the constructor precisely because (1) the copy constructor implementation is missing from the the header (so it can't be inlined) and (2) the boolean-argument constructor is constructed into a temporary (so the analyzer decides not to inline it since it doesn't reliably call temporary destructors right now). This results in false positives because the analyzer does not realize that the the assertion must hold along the non-return path. This commit addresses the false positives by explicitly modeling the effects of the two un-inlined constructors on the AssertionResult state. I've added a new package, "apiModeling", for these kinds of checkers that model APIs but don't emit any diagnostics. I envision all the checkers in this package always being on by default. This addresses the false positives reported in PR30936. Differential Revision: https://reviews.llvm.org/D27773 rdar://problem/22705813 llvm-svn: 290143
* [analyzer] Detect ObjC properties that are both (copy) and Mutable.Artem Dergachev2016-12-131-0/+1
| | | | | | | | | | | | | | | When an Objective-C property has a (copy) attribute, the default setter for this property performs a -copy on the object assigned. Calling -copy on a mutable NS object such as NSMutableString etc. produces an immutable object, NSString in our example. Hence the getter becomes type-incorrect. rdar://problem/21022397 Differential Revision: https://reviews.llvm.org/D27535 llvm-svn: 289554
* [analyzer] Add StdLibraryFunctions checker.Artem Dergachev2016-10-241-0/+1
| | | | | | | | | | | | | | | This checker does not emit reports, however it influences the analysis by providing complete summaries for, or otherwise improving modeling of, various standard library functions. This should reduce the number of infeasible paths explored during analysis. The custom function summary format used in this checker is superior to body farms by causing less unnecessary state splits, which would result in better analysis performance. Differential Revision: https://reviews.llvm.org/D20811 llvm-svn: 284960
* [analyzer] Add NumberObjectConversion checker.Artem Dergachev2016-10-181-0/+1
| | | | | | | | | | | | | | | | | When dealing with objects that represent numbers, such as Objective-C NSNumber, the language provides little protection from accidentally interpreting the value of a pointer to such object as the value of the number represented by the object. Results of such mis-interpretation may be unexpected. The checker attempts to fill this gap in cases when the code is obviously incorrect. With "Pedantic" option enabled, this checker enforces a coding style to completely prevent errors of this kind (off by default). Differential Revision: https://reviews.llvm.org/D22968 llvm-svn: 284473
* [analyzer] Link libStaticAnalyzerCheckers to libASTMatchers.Artem Dergachev2016-10-131-0/+1
| | | | | | | | | | | | | AST matchers are useful for the analyzer's checkers. More patches on particular checkers shall follow. This is the first time clang binary gets linked to ASTMatchers. The binary size increase for the clang executable would be +0.5% in release mode, +2% in debug mode. Differential Revision: https://reviews.llvm.org/D25429 llvm-svn: 284112
* [analyzer] Add a checker that detects blocks in critical sectionsAnna Zaks2016-09-201-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | This checker should find the calls to blocking functions (for example: sleep, getc, fgets,read,recv etc.) inside a critical section. When sleep(x) is called while a mutex is held, other threads cannot lock the same mutex. This might take some time, leading to bad performance or even deadlock. Example: mutex_t m; void f() { sleep(1000); // Error: sleep() while m is locked! [f() is called from foobar() while m is locked] // do some work } void foobar() { lock(m); f(); unlock(m); } A patch by zdtorok (Zoltán Dániel Török)! Differential Revision: https://reviews.llvm.org/D21506 llvm-svn: 282011
* [analyzer] ExprEngine: remove second call to PreStmt<CastExpr>Aleksei Sidorin2016-09-011-0/+1
| | | | | | | | | This patch also introduces AnalysisOrderChecker which is intended for testing of callback call correctness. Differential Revision: https://reviews.llvm.org/D23804 llvm-svn: 280367
* Reapply "[analyzer] Added valist related checkers."Gabor Horvath2016-08-221-0/+1
| | | | | | Differential Revision: https://reviews.llvm.org/D15227 llvm-svn: 279427
* revert [analyzer] Added valist related checkers.Gabor Horvath2016-08-181-1/+0
| | | | llvm-svn: 279043
* [analyzer] Added valist related checkers.Gabor Horvath2016-08-181-0/+1
| | | | | | Differential Revision: https://reviews.llvm.org/D15227 llvm-svn: 279041
* [analyzer] Add a checker for loss of sign or precision in integral casts.Artem Dergachev2016-08-171-0/+1
| | | | | | | | | | | | | | | This new checker tries to find execution paths on which implicit integral casts cause definite loss of information: a certainly-negative integer is converted to an unsigned integer, or an integer is definitely truncated to fit into a smaller type. Being implicit, such casts are likely to produce unexpected results. Patch by Daniel Marjamäki! Differential Revision: https://reviews.llvm.org/D13126 llvm-svn: 278941
OpenPOWER on IntegriCloud