summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp
Commit message (Collapse)AuthorAgeFilesLines
* [analyzer] CStringChecker: Remember to highlight the argument expression range.Artem Dergachev2018-07-301-0/+1
| | | | | | | | | | | | | | | | | | | | | When emitting a bug report, it is important to highlight which argument of the call-expression is causing the problem. Before: warning: Null pointer argument in call to string comparison function   strcmp(a, b);   ^~~~~~~~~~~~ After: warning: Null pointer argument in call to string comparison function   strcmp(a, b);   ^      ~ Affects other output modes as well, not just text. Differential Revision: https://reviews.llvm.org/D50028 llvm-svn: 338333
* [Analyzer] alpha.unix.cstring.OutOfBounds checker enable/disable fixAdam Balogh2018-07-131-6/+6
| | | | | | | | | | | | | | | | | | It was not possible to disable alpha.unix.cstring.OutOfBounds checker's reports since unix.Malloc checker always implicitly enabled the filter. Moreover if the checker was disabled from command line (-analyzer-disable-checker ..) the out of bounds warnings were nevertheless emitted under different checker names such as unix.cstring.NullArg, or unix.Malloc. This patch fixes the case sot that Malloc checker only enables implicitly the underlying modeling of strcpy, memcpy etc. but not the warning messages that would have been emmitted by alpha.unix.cstring.OutOfBounds Patch by: Dániel Krupp Differential Revision: https://reviews.llvm.org/D48831 llvm-svn: 337000
* [analyzer] CStringChecker fix for strlcpy when no bytes are copied to the ↵David Carlier2018-05-231-1/+5
| | | | | | | | | | | | | | dest buffer Again, strlc* does not return a pointer so the zero size case doest not fit. Reviewers: NoQ, george.karpenkov Reviewed by: NoQ Differential Revision: https://reviews.llvm.org/D47007 llvm-svn: 333060
* [analyzer] Improve the modeling of memset().Henry Wong2018-05-161-3/+99
| | | | | | | | | | | | Since there is no perfect way bind the non-zero value with the default binding, this patch only considers the case where buffer's offset is zero and the char value is 0. And according to the value for overwriting, decide how to update the string length. Reviewers: dcoughlin, NoQ, xazax.hun, a.sidorin, george.karpenkov Reviewed By: NoQ Differential Revision: https://reviews.llvm.org/D44934 llvm-svn: 332463
* [analyzer] Re-apply r331096 "CStringChecker: Add support for BSD strlcpy()...".Artem Dergachev2018-05-141-54/+97
| | | | | | | | | | Fixed after revert in r331401. Patch by David Carlier! Differential Revision: https://reviews.llvm.org/D45177 llvm-svn: 332303
* [analyzer] Revert r331096 "CStringChecker: Add support for BSD strlcpy()...".Artem Dergachev2018-05-021-39/+2
| | | | | | | | | The return values of the newly supported functions were not handled correctly: strlcpy()/strlcat() return string sizes rather than pointers. Differential Revision: https://reviews.llvm.org/D45177 llvm-svn: 331401
* [analyzer] CStringChecker: Add support for BSD strlcpy() and strlcat().Artem Dergachev2018-04-271-2/+39
| | | | | | | | Patch by David Carlier! Differential Revision: https://reviews.llvm.org/D45177 llvm-svn: 331096
* [analyzer] CStringChecker.cpp - Code refactoring on bug report.Henry Wong2018-04-231-100/+96
| | | | | | | | | | Reviewers: NoQ, george.karpenkov, xazax.hun Reviewed By: george.karpenkov Differential Revision: https://reviews.llvm.org/D44557 llvm-svn: 330589
* [analyzer] Fix assertion crash in CStringCheckerGeorge Karpenkov2018-03-311-5/+8
| | | | | | | | | | An offset might be unknown. rdar://39054939 Differential Revision: https://reviews.llvm.org/D45115 llvm-svn: 328912
* Revert r326782 "[analyzer] CStringChecker.cpp: Remove the duplicated check...".Artem Dergachev2018-03-211-0/+21
| | | | | | | It seems that the refactoring was causing a functional change and some warnings have disappeared. llvm-svn: 328067
* [analyzer] CStringChecker.cpp: Remove the duplicated check about null ↵Henry Wong2018-03-061-21/+0
| | | | | | | | | | | | | | | | dereference on dest-buffer or src-buffer. Summary: `CheckBufferAccess()` calls `CheckNonNull()`, so there are some calls to `CheckNonNull()` that are useless. Reviewers: dcoughlin, NoQ, xazax.hun, cfe-commits, george.karpenkov Reviewed By: NoQ Subscribers: szepet, rnkovacs, MTC, a.sidorin Differential Revision: https://reviews.llvm.org/D44075 llvm-svn: 326782
* [analyzer] Provide a check name when MallocChecker enables CStringCheckerDevin Coughlin2018-01-201-1/+11
| | | | | | | | | Fix an assertion failure caused by a missing CheckName. The malloc checker enables "basic" support in the CStringChecker, which causes some CString bounds checks to be enabled. In this case, make sure that we have a valid CheckName for the BugType. llvm-svn: 323052
* [analyzer] introduce getSVal(Stmt *) helper on ExplodedNode, make sure the ↵George Karpenkov2018-01-171-3/+3
| | | | | | | | | | | | | | | | | | helper is used consistently In most cases using `N->getState()->getSVal(E, N->getLocationContext())` is ugly, verbose, and also opens up more surface area for bugs if an inconsistent location context is used. This patch introduces a helper on an exploded node, and ensures consistent usage of either `ExplodedNode::getSVal` or `CheckContext::getSVal` across the codebase. As a result, a large number of redundant lines is removed. Differential Revision: https://reviews.llvm.org/D42155 llvm-svn: 322753
* [analyzer] pr34779: CStringChecker: Accept non-standard headers.Artem Dergachev2017-11-071-2/+4
| | | | | | | | | | | Do not crash when trying to define and call a non-standard strcpy(unsigned char *, unsigned char *) during analysis. At the same time, do not try to actually evaluate the call. Differential Revision: https://reviews.llvm.org/D39422 llvm-svn: 317565
* [analyzer] CStringChecker: pr34460: Avoid a crash when a cast is not modeled.Artem Dergachev2017-10-131-23/+14
| | | | | | | | | | | | | | | | | The checker used to crash when a mempcpy's length argument is symbolic. In this case the cast from 'void *' to 'char *' failed because the respective ElementRegion that represents cast is hard to add on top of the existing ElementRegion that represents the offset to the last copied byte, while preseving a sane memory region structure. Additionally, a few test cases are added (to casts.c) which demonstrate problems caused by existing sloppy work we do with multi-layer ElementRegions. If said cast would be modeled properly in the future, these tests would need to be taken into account. Differential Revision: https://reviews.llvm.org/D38797 llvm-svn: 315742
* [analyzer] Check NULL pointer dereference issue for memset functionLeslie Zhai2017-06-201-0/+51
| | | | | | | | | | Reviewers: dcoughlin, zaks.anna, NoQ, danielmarjamaki Reviewed By: NoQ, danielmarjamaki Differential Revision: https://reviews.llvm.org/D31868 llvm-svn: 305773
* [analyzer] Add LocationContext as a parameter to checkRegionChangesAnna Zaks2017-01-131-2/+8
| | | | | | | | | | | This patch adds LocationContext to checkRegionChanges and removes wantsRegionChangeUpdate as it was unused. A patch by Krzysztof Wiśniewski! Differential Revision: https://reviews.llvm.org/D27090 llvm-svn: 291869
* [analyzer] Remove unused check::RegionChanges::wantsRegionChangeUpdate callbackAnna Zaks2016-11-161-6/+0
| | | | | | | | | | | Remove the check::RegionChanges::wantsRegionChangeUpdate callback as it is no longer used (since checkPointerEscape has been added). A patch by Krzysztof Wiśniewski! Differential Revision: https://reviews.llvm.org/D26759 llvm-svn: 287175
* [analyzer] Add LocationContext information to SymbolMetadata.Artem Dergachev2016-08-171-0/+1
| | | | | | | | | | | | | | | | | | | | | Like SymbolConjured, SymbolMetadata also needs to be uniquely identified by the moment of its birth. Such moments are coded by the (Statement, LocationContext, Block count) triples. Each such triple represents the moment of analyzing a statement with a certain call backtrace, with corresponding CFG block having been entered a given amount of times during analysis of the current code body. The LocationContext information was accidentally omitted for SymbolMetadata, which leads to reincarnation of SymbolMetadata upon re-entering a code body with a different backtrace; the new symbol is incorrectly unified with the old symbol, which leads to unsound assumptions. Patch by Alexey Sidorin! Differential Revision: https://reviews.llvm.org/D21978 llvm-svn: 278937
* [NFC] Header cleanupMehdi Amini2016-07-181-1/+0
| | | | | | | | | | Summary: Removed unused headers, replaced some headers with forward class declarations Patch by: Eugene <claprix@yandex.ru> Differential Revision: https://reviews.llvm.org/D20100 llvm-svn: 275882
* [analyzer] Fix for PR23790 : constrain return value of strcmp() rather than ↵Anton Yartsev2016-05-191-17/+20
| | | | | | | | | | returning a concrete value. The function strcmp() can return any value, not just {-1,0,1} : "The strcmp(const char *s1, const char *s2) function returns an integer greater than, equal to, or less than zero, accordingly as the string pointed to by s1 is greater than, equal to, or less than the string pointed to by s2." [C11 7.24.4.2p3] https://llvm.org/bugs/show_bug.cgi?id=23790 http://reviews.llvm.org/D16317 llvm-svn: 270154
* [analyzer] Let TK_PreserveContents span across the whole base region.Artem Dergachev2016-04-251-1/+1
| | | | | | | | | | | | If an address of a field is passed through a const pointer, the whole structure's base region should receive the TK_PreserveContents trait and avoid invalidation. Additionally, include a few FIXME tests shown up during testing. Differential Revision: http://reviews.llvm.org/D19057 llvm-svn: 267413
* [analyzer] Invalidate destination of std::copy() and std::copy_backward().Devin Coughlin2016-02-071-0/+58
| | | | | | | | | Now that the libcpp implementations of these methods has a branch that doesn't call memmove(), the analyzer needs to invalidate the destination for these methods explicitly. rdar://problem/23575656 llvm-svn: 260043
* [analyzer] Fix SVal/SymExpr/MemRegion class and enum names for consistency.Artem Dergachev2016-01-131-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The purpose of these changes is to simplify introduction of definition files for the three hierarchies. 1. For every sub-class C of these classes, its kind in the relevant enumeration is changed to "CKind" (or C##Kind in preprocessor-ish terms), eg: MemRegionKind -> MemRegionValKind RegionValueKind -> SymbolRegionValueKind CastSymbolKind -> SymbolCastKind SymIntKind -> SymIntExprKind 2. MemSpaceRegion used to be inconsistently used as both an abstract base and a particular region. This region class is now an abstract base and no longer occupies GenericMemSpaceRegionKind. Instead, a new class, CodeSpaceRegion, is introduced for handling the unique use case for MemSpaceRegion as "the generic memory space" (when it represents a memory space that holds all executable code). 3. BEG_ prefixes in memory region kind ranges are renamed to BEGIN_ for consisitency with symbol kind ranges. 4. FunctionTextRegion and BlockTextRegion are renamed to FunctionCodeRegion and BlockCodeRegion, respectively. The term 'code' is less jargony than 'text' and we already refer to BlockTextRegion as a 'code region' in BlockDataRegion. Differential Revision: http://reviews.llvm.org/D16062 llvm-svn: 257598
* Refactor: Simplify boolean conditional return statements in ↵Alexander Kornienko2015-12-281-4/+1
| | | | | | | | | | | | | | | | lib/StaticAnalyzer/Checkers Summary: Use clang-tidy to simplify boolean conditional return values Reviewers: dcoughlin, krememek Subscribers: krememek, cfe-commits Patch by Richard Thomson! Differential Revision: http://reviews.llvm.org/D10021 llvm-svn: 256491
* [analyzer] When memcpy'ing into a fixed-size array, do not invalidate entire ↵Devin Coughlin2015-09-241-7/+91
| | | | | | | | | | | | | | | | | | | | region. Change the analyzer's modeling of memcpy to be more precise when copying into fixed-size array fields. With this change, instead of invalidating the entire containing region the analyzer now invalidates only offsets for the array itself when it can show that the memcpy stays within the bounds of the array. This addresses false positive memory leak warnings of the kind reported by krzysztof in https://llvm.org/bugs/show_bug.cgi?id=22954 (This is the second attempt, now with assertion failures resolved.) A patch by Pierre Gousseau! Differential Revision: http://reviews.llvm.org/D12571 llvm-svn: 248516
* [analyzer] Add generateErrorNode() APIs to CheckerContext.Devin Coughlin2015-09-161-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The analyzer trims unnecessary nodes from the exploded graph before reporting path diagnostics. However, in some cases it can trim all nodes (including the error node), leading to an assertion failure (see https://llvm.org/bugs/show_bug.cgi?id=24184). This commit addresses the issue by adding two new APIs to CheckerContext to explicitly create error nodes. Unless the client provides a custom tag, these APIs tag the node with the checker's tag -- preventing it from being trimmed. The generateErrorNode() method creates a sink error node, while generateNonFatalErrorNode() creates an error node for a path that should continue being explored. The intent is that one of these two methods should be used whenever a checker creates an error node. This commit updates the checkers to use these APIs. These APIs (unlike addTransition() and generateSink()) do not take an explicit Pred node. This is because there are not any error nodes in the checkers that were created with an explicit different than the default (the CheckerContext's Pred node). It also changes generateSink() to require state and pred nodes (previously these were optional) to reduce confusion. Additionally, there were several cases where checkers did check whether a generated node could be null; we now explicitly check for null in these places. This commit also includes a test case written by Ying Yi as part of http://reviews.llvm.org/D12163 (that patch originally addressed this issue but was reverted because it introduced false positive regressions). Differential Revision: http://reviews.llvm.org/D12780 llvm-svn: 247859
* [analyzer] Apply whitespace cleanups by Honggyu Kim.Ted Kremenek2015-09-081-42/+42
| | | | llvm-svn: 246978
* Revert r246345 until an assertion is fixed.Gabor Horvath2015-08-311-85/+7
| | | | llvm-svn: 246479
* [analyzer] When memcpy'ing into a fixed-size array, do not invalidate entire ↵Devin Coughlin2015-08-281-7/+85
| | | | | | | | | | | | | | | | | | region. Change the analyzer's modeling of memcpy to be more precise when copying into fixed-size array fields. With this change, instead of invalidating the entire containing region the analyzer now invalidates only offsets for the array itself when it can show that the memcpy stays within the bounds of the array. This addresses false positive memory leak warnings of the kind reported by krzysztof in https://llvm.org/bugs/show_bug.cgi?id=22954 A patch by Pierre Gousseau! Differential Revision: http://reviews.llvm.org/D11832 llvm-svn: 246345
* Clarify pointer ownership semantics by hoisting the std::unique_ptr creation ↵Aaron Ballman2015-06-231-17/+15
| | | | | | to the caller instead of hiding it in emitReport. NFC. llvm-svn: 240400
* Remove the assertion as it was useless and broken.Sylvestre Ledru2015-04-171-4/+0
| | | | | | | | | | | | | Enforcing the assert caused the following tests to fail: Clang :: Analysis__bstring.c Clang :: Analysis__comparison-implicit-casts.cpp Clang :: Analysis__malloc-interprocedural.c Clang :: Analysis__malloc.c Clang :: Analysis__redefined_system.c Clang :: Analysis__string.c Clang :: Analysis__weak-functions.c llvm-svn: 235190
* Fix a bad assert. Found by coverity. CID 1101110Sylvestre Ledru2015-04-171-1/+1
| | | | llvm-svn: 235188
* [analyzer] Make CStringChecker correctly calculate return value of mempcpyAnna Zaks2014-10-031-1/+6
| | | | | | | | | | The return value of mempcpy is only correct when the destination type is one byte in size. This patch casts the argument to a char* so the calculation is also correct for structs, ints etc. A patch by Daniel Fahlgren! llvm-svn: 219024
* [C++11] Use 'nullptr'. StaticAnalyzer edition.Craig Topper2014-05-271-36/+41
| | | | llvm-svn: 209642
* [C++11] Replacing DeclStmt iterators decl_begin() and decl_end() with ↵Aaron Ballman2014-03-141-3/+2
| | | | | | iterator_range decls(). Updating all of the usages of the iterators with range-based for loops. llvm-svn: 203947
* Replace OwningPtr with std::unique_ptr.Ahmed Charles2014-03-071-5/+2
| | | | | | This compiles cleanly with lldb/lld/clang-tools-extra/llvm. llvm-svn: 203279
* [C++11] Replace llvm::tie with std::tie.Benjamin Kramer2014-03-021-16/+16
| | | | llvm-svn: 202639
* Expose the name of the checker producing each diagnostic message.Alexander Kornienko2014-02-111-17/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | Summary: In clang-tidy we'd like to know the name of the checker producing each diagnostic message. PathDiagnostic has BugType and Category fields, which are both arbitrary human-readable strings, but we need to know the exact name of the checker in the form that can be used in the CheckersControlList option to enable/disable the specific checker. This patch adds the CheckName field to the CheckerBase class, and sets it in the CheckerManager::registerChecker() method, which gets them from the CheckerRegistry. Checkers that implement multiple checks have to store the names of each check in the respective registerXXXChecker method. Reviewers: jordan_rose, krememek Reviewed By: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D2557 llvm-svn: 201186
* [analyzer] Better modeling of memcpy by the CStringChecker (PR16731).Anton Yartsev2013-11-171-13/+41
| | | | | | | | | | | | | | New rules of invalidation/escape of the source buffer of memcpy: the source buffer contents is invalidated and escape while the source buffer region itself is neither invalidated, nor escape. In the current modeling of memcpy the information about allocation state of regions, accessible through the source buffer, is not copied to the destination buffer and we can not track the allocation state of those regions anymore. So we invalidate/escape the source buffer indirect regions in anticipation of their being invalidated for real later. This eliminates false-positive leaks reported by the unix.Malloc and alpha.cplusplus.NewDeleteLeaks checkers for the cases like char *f() { void *x = malloc(47); char *a; memcpy(&a, &x, sizeof a); return a; } llvm-svn: 194953
* [analyzer] Replace bug category magic strings with shared constants, take 2.Jordan Rose2013-10-041-4/+4
| | | | | | | Re-commit r191910 (reverted in r191936) with layering violation fixed, by moving the bug categories to StaticAnalyzerCore instead of ...Checkers. llvm-svn: 191937
* Temporarily revert r191910 until the layering violation can be fixed.Richard Smith2013-10-031-4/+4
| | | | llvm-svn: 191936
* [analyzer] Replace bug category magic strings with shared constants.Jordan Rose2013-10-031-4/+4
| | | | | | | | | | One small functionality change is to bring the sizeof-pointer checker in line with the other checkers by making its category be "Logic error" instead of just "Logic". There should be no other functionality changes. Patch by Daniel Marjamäki! llvm-svn: 191910
* [analyzer] Assume that strings are no longer than SIZE_MAX/4.Jordan Rose2013-08-191-2/+15
| | | | | | | | | This keeps the analyzer from making silly assumptions, like thinking strlen(foo)+1 could wrap around to 0. This fixes PR16558. Patch by Karthik Bhat! llvm-svn: 188680
* Fix memory corruption in CStringCheckerPavel Labath2013-06-121-4/+1
| | | | | | | | | | | | | | | Summary: "register" functions for the checker were caching the checker objects in a static variable. This caused problems when the function is called with a different CheckerManager. Reviewers: klimek CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D955 llvm-svn: 183823
* [analyzer] Model strsep(), particularly that it returns its input.Jordan Rose2013-04-221-0/+62
| | | | | | | This handles the false positive leak warning in PR15374, and also serves as a basic model for the strsep() function. llvm-svn: 180069
* Replace ProgramPoint llvm::cast support to be well-defined.David Blaikie2013-02-211-1/+1
| | | | | | See r175462 for another example/more details. llvm-svn: 175812
* Include llvm::Optional in clang/Basic/LLVM.hDavid Blaikie2013-02-201-33/+28
| | | | | | Post-commit CR feedback from Jordan Rose regarding r175594. llvm-svn: 175679
* Replace SVal llvm::cast support to be well-defined.David Blaikie2013-02-201-80/+74
| | | | | | See r175462 for another example/more details. llvm-svn: 175594
* Remove some stray uses of <ctype.h> functions.Jordan Rose2013-02-091-1/+2
| | | | | | These are causing assertions on some MSVC builds. llvm-svn: 174805
OpenPOWER on IntegriCloud