summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp
Commit message (Collapse)AuthorAgeFilesLines
* Sort all of Clang's files under 'lib', and fix up the broken headersChandler Carruth2012-12-041-2/+2
| | | | | | | | | | | | | uncovered. This required manually correcting all of the incorrect main-module headers I could find, and running the new llvm/utils/sort_includes.py script over the files. I also manually added quite a few missing headers that were uncovered by shuffling the order or moving headers up to be main-module-headers. llvm-svn: 169237
* Include pruning and general cleanup.Benjamin Kramer2012-12-011-0/+1
| | | | llvm-svn: 169095
* [analyzer] Use nice macros for the common ProgramStateTraits (map, set, list).Jordan Rose2012-11-021-22/+10
| | | | | | | | | Also, move the REGISTER_*_WITH_PROGRAMSTATE macros to ProgramStateTrait.h. This doesn't get rid of /all/ explicit uses of ProgramStatePartialTrait, but it does get a lot of them. llvm-svn: 167276
* [analyzer] Rename 'EmitReport' to 'emitReport'.Jordan Rose2012-11-021-6/+6
| | | | | | No functionality change. llvm-svn: 167275
* [analyzer] Teach the analyzer about implicit initialization of staticsAnna Zaks2012-09-171-1/+1
| | | | | | | | | | | in ObjCMethods. Extend FunctionTextRegion to represent ObjC methods as well as functions. Note, it is not clear what type ObjCMethod region should return. Since the type of the FunctionText region is not currently used, defer solving this issue. llvm-svn: 164046
* [analyzer] Rename addTrackNullOrUndefValueVisitor to trackNullOrUndefValue.Jordan Rose2012-08-281-1/+1
| | | | | | | | | | | This helper function (in the clang::ento::bugreporter namespace) may add more than one visitor, but conceptually it's tracking a single use of a null or undefined value and should do so as best it can. Also, the BugReport parameter has been made a reference to underscore that it is non-optional. llvm-svn: 162720
* Rename 'unbindLoc()' (in ProgramState) and 'Remove()' toTed Kremenek2012-08-221-1/+1
| | | | | | | | | 'killBinding()'. The name is more specific, and one just forwarded to the other. Add some doxygen comments along the way. llvm-svn: 162350
* Rename 'currentX' to 'currX' throughout analyzer and libAnalysis.Ted Kremenek2012-08-221-16/+10
| | | | | | | | | Also rename 'getCurrentBlockCounter()' to 'blockCount()'. This ripples a bunch of code simplifications; mostly aesthetic, but makes the code a bit tighter. llvm-svn: 162349
* Rename 'getConjuredSymbol*' to 'conjureSymbol*'.Ted Kremenek2012-08-221-7/+6
| | | | | | | | | | No need to have the "get", the word "conjure" is a verb too! Getting a conjured symbol is the same as conjuring one up. This shortening is largely cosmetic, but just this simple changed cleaned up a handful of lines, making them less verbose. llvm-svn: 162348
* [analyzer] When a symbol is null, we should track its constraints.Jordan Rose2012-08-031-2/+1
| | | | | | | | Because of this, we would previously emit NO path notes when a parameter is constrained to null (because there are no stores). Now we show where we made the assumption, which is much more useful. llvm-svn: 161280
* [analyzer] Add a new abstraction over all types of calls: CallEventJordan Rose2012-07-021-2/+2
| | | | | | | | | | This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
* [analyzer] strncpy: Special-case a length of 0 to avoid an incorrect warning.Jordy Rose2012-05-141-0/+18
| | | | | | | | | | We check the address of the last element accessed, but with 0 calculating that address results in element -1. This patch bails out early (and avoids a bunch of other work at that). Fixes PR12807. llvm-svn: 156769
* [analyzer] CString Checker: Do not split the path unless the userAnna Zaks2012-05-031-1/+2
| | | | | | | | | | specifically checks for equality to null. Enforcing this general practice, which keeps the analyzer less noisy, in the CString Checker. This change suppresses "Assigned value is garbage or undefined" warning in the added test case. llvm-svn: 156085
* [analyzer] Don't crash even when the system functions are redefined.Anna Zaks2012-04-101-0/+48
| | | | | | | | | | (Applied changes to CStringAPI, Malloc, and Taint.) This might almost never happen, but we should not crash even if it does. This fixes a crash on the internal analyzer buildbot, where postgresql's configure was redefining memmove (radar://11219852). llvm-svn: 154451
* [analyzer] Implement basic path diagnostic pruning based on "interesting" ↵Ted Kremenek2012-03-091-1/+2
| | | | | | | | | | | | | | | | | symbols and regions. Essentially, a bug centers around a story for various symbols and regions. We should only include the path diagnostic events that relate to those symbols and regions. The pruning is done by associating a set of interesting symbols and regions with a BugReporter, which can be modified at BugReport creation or by BugReporterVisitors. This patch reduces the diagnostics emitted in several of our test cases. I've vetted these as having desired behavior. The only regression is a missing null check diagnostic for the return value of realloc() in test/Analysis/malloc-plist.c. This will require some investigation to fix, and I have added a FIXME to the test case. llvm-svn: 152361
* Have conjured symbols depend on LocationContext, to add context sensitivity ↵Ted Kremenek2012-02-171-7/+8
| | | | | | for functions called more than once. llvm-svn: 150849
* [analyzer] Fix another false positive in the Malloc Checker, by makingAnna Zaks2012-02-171-0/+5
| | | | | | | | | | | | it aware of CString APIs that return the input parameter. Malloc Checker needs to know how the 'strcpy' function is evaluated. Introduce the dependency on CStringChecker for that. CStringChecker knows all about these APIs. Addresses radar://10864450 llvm-svn: 150846
* [analyzer] Generalize function name checking in CString checker.Anna Zaks2012-02-171-23/+39
| | | | | | | (Ex: It was not treating __inline_strcpy as strcpy. Will add tests that rely on this later on.) llvm-svn: 150845
* [analyzer] Make Malloc Checker optimistic in presence of inlining.Anna Zaks2012-02-141-2/+4
| | | | | | | | | | | | (In response of Ted's review of r150112.) This moves the logic which checked if a symbol escapes through a parameter to invalidateRegionCallback (instead of post CallExpr visit.) To accommodate the change, added a CallOrObjCMessage parameter to checkRegionChanges callback. llvm-svn: 150513
* [analyzer] Allow each CString check to be enabled/disabledAnna Zaks2012-02-071-9/+62
| | | | | | separately. llvm-svn: 149947
* Basic: import SmallString<> into clang namespaceDylan Noblesmith2012-02-051-4/+4
| | | | | | | (I was going to fix the TODO about DenseMap too, but that would break self-host right now. See PR11922.) llvm-svn: 149799
* Basic: import OwningPtr<> into clang namespaceDylan Noblesmith2012-02-051-1/+1
| | | | llvm-svn: 149798
* Move a method from IdentifierTable.h out of line and remove the SmallString ↵Benjamin Kramer2012-02-041-0/+1
| | | | | | | | include. Fix all the transitive include users. llvm-svn: 149783
* Move various diagnostic operator<< overloads out of line and remove includes ↵Benjamin Kramer2012-02-041-0/+1
| | | | | | | | | of Diagnostic.h. Fix all the files that depended on transitive includes of Diagnostic.h. With this patch in place changing a diagnostic no longer requires a full rebuild of the StaticAnalyzer. llvm-svn: 149781
* Change references to 'const ProgramState *' to typedef 'ProgramStateRef'.Ted Kremenek2012-01-261-72/+72
| | | | | | | | At this point this is largely cosmetic, but it opens the door to replace ProgramStateRef with a smart pointer that more eagerly acts in the role of reclaiming unused ProgramState objects. llvm-svn: 149081
* [analyzer] Make the entries in 'Environment' context-sensitive by making ↵Ted Kremenek2012-01-061-36/+49
| | | | | | | | | | | | | | | | | | entries map from (Stmt*,LocationContext*) pairs to SVals instead of Stmt* to SVals. This is needed to support basic IPA via inlining. Without this, we cannot tell if a Stmt* binding is part of the current analysis scope (StackFrameContext) or part of a parent context. This change introduces an uglification of the use of getSVal(), and thus takes two steps forward and one step back. There are also potential performance implications of enlarging the Environment. Both can be addressed going forward by refactoring the APIs and optimizing the internal representation of Environment. This patch mainly introduces the functionality upon when we want to build upon (and clean up). llvm-svn: 147688
* [analyzer] CStringChecker should not rely on the analyzer generating ↵Anna Zaks2011-12-111-4/+5
| | | | | | | | | | | | | | UndefOrUnknown value when it cannot reason about the expression. We are now often generating expressions even if the solver is not known to be able to simplify it. This is another cleanup of the existing code, where the rest of the analyzer and checkers should not base their logic on knowing ahead of the time what the solver can reason about. In this case, CStringChecker is performing a check for overflow of 'left+right' operation. The overflow can be checked with either 'maxVal-left' or 'maxVal-right'. Previously, the decision was based on whether the expresion evaluated to undef or not. With this patch, we check if one of the arguments is a constant, in which case we know that 'maxVal-const' is easily simplified. (Another option is to use canReasonAbout() method of the solver here, however, it's currently is protected.) This patch also contains 2 small bug fixes: - swap the order of operators inside SValBuilder::makeGenericVal. - handle a case when AddeVal is unknown in GenericTaintChecker::getPointedToSymbol. llvm-svn: 146343
* [analyzer] Refactor: Move symbol_iterator from SVal to SymExpr, use itAnna Zaks2011-12-061-2/+2
| | | | | | for finding dependent symbols for taint. llvm-svn: 145986
* [analyzer] Refactor checkers to use helper function for getting callee Decl ↵Anna Zaks2011-12-011-13/+2
| | | | | | | | and name. We are getting name of the called function or it's declaration in a few checkers. Refactor them to use the helper function in the CheckerContext. llvm-svn: 145576
* [analyzer] Add getLocationContext to CheckerContextAnna Zaks2011-10-261-1/+1
| | | | | | | CheckerContext::getPredecessor is only used to get to the LocationContext half of the times. llvm-svn: 143061
* [analyzer] Rename generateNode -> addTransition in CheckerContextAnna Zaks2011-10-261-14/+14
| | | | | | Also document addTransition methods. llvm-svn: 143059
* [analyzer] Simplify CheckerContextAnna Zaks2011-10-251-11/+11
| | | | | | | | | Remove dead members/parameters: ProgramState, respondsToCallback, autoTransition. Remove addTransition method since it's the same as generateNode. Maybe we should rename generateNode to genTransition (since a transition is always automatically generated)? llvm-svn: 142946
* Change operator<< for raw_ostream and NamedDecl to take a reference instead ↵Benjamin Kramer2011-10-141-1/+1
| | | | | | | | of a pointer. Passing a pointer was a bad idea as it collides with the overload for void*. llvm-svn: 141971
* [analyzer] Fix a typo.Anna Zaks2011-10-111-1/+1
| | | | llvm-svn: 141678
* [analyzer] Removing references to CheckerContext::getNodeBuilder(): checkers ↵Anna Zaks2011-10-041-8/+8
| | | | | | can obtain block count directly from the Context. llvm-svn: 141112
* [analyzer] Change the check::RegionChanges callback to include the regions ↵Jordy Rose2011-08-271-7/+8
| | | | | | | | | | explicitly requested for invalidation. Also, allow CallOrObjCMessage to wrap a CXXConstructExpr as well. Finally, this allows us to remove the clunky whitelisting system from CFRefCount/RetainReleaseChecker. Slight regression due to CXXNewExprs not yet being handled in post-statement callbacks (PR forthcoming). llvm-svn: 138716
* Static Analyzer Diagnostics: Kill the addVisitorCreator(callbackTy, void*) ↵Anna Zaks2011-08-191-1/+1
| | | | | | | | | | | | API in favor of addVisitor(BugReporterVisitor*). 1) Create a header file to expose the predefined visitors. And move the parent(BugReporterVisitor) there as well. 2) Remove the registerXXXVisitor functions - the Visitor constructors/getters can be used now to create the object. One exception is registerVarDeclsLastStore(), which registers more then one visitor, so make it static member of FindLastStoreBRVisitor. 3) Modify all the checkers to use the new API. llvm-svn: 138126
* Remove EnhancedBugReport and RangedBugReport - pull all the extra ↵Anna Zaks2011-08-171-8/+8
| | | | | | functionality they provided into their parent BugReport. The only functional changes are: made getRanges() non const - it adds default range to Ranges if none are supplied, made getStmt() private, which was another FIXME. llvm-svn: 137894
* Rename GRState to ProgramState, and cleanup some code formatting along the way.Ted Kremenek2011-08-151-98/+126
| | | | llvm-svn: 137665
* Cleanup various declarations of 'Stmt*' to be 'Stmt *', etc. in libAnalyzer ↵Ted Kremenek2011-08-121-2/+2
| | | | | | and libStaticAnalyzer[*]. It was highly inconsistent, and very ugly to look at. llvm-svn: 137537
* [analyzer] Nitpicks on Olaf's patch, which I meant to e-mail but then didn't inJordy Rose2011-08-121-3/+2
| | | | | | time. One is cleanup, the other is me being OCD about enum group nesting. llvm-svn: 137517
* [analyzer] Introduce new MemRegion, "TypedValueRegion", so that we can ↵Ted Kremenek2011-08-121-6/+5
| | | | | | | | separate TypedRegions that implement getValueType() from those that don't. Patch by Olaf Krzikalla! llvm-svn: 137498
* remove unneeded llvm:: namespace qualifiers on some core types now that ↵Chris Lattner2011-07-231-7/+7
| | | | | | | | LLVM.h imports them into the clang namespace. llvm-svn: 135852
* [analyzer] Finish size argument checking for strncat (and strncpy).Jordy Rose2011-06-201-30/+80
| | | | llvm-svn: 133472
* [analyzer] Replace stream-built error message with constant string. No ↵Jordy Rose2011-06-201-5/+4
| | | | | | functionality change. llvm-svn: 133410
* [analyzer] Re-enable checking for strncpy, along with a new validation of ↵Jordy Rose2011-06-201-9/+32
| | | | | | the size argument. strncat is not yet up-to-date, but I'm leaving it enabled for now (there shouldn't be any false positives, at least...) llvm-svn: 133408
* [analyzer] Eliminate "byte string function" from CStringChecker's ↵Jordy Rose2011-06-201-30/+67
| | | | | | diagnostics, and make it easier to provide custom messages for overflow checking, in preparation for re-enabling strncpy checking. llvm-svn: 133406
* [analyzer] Clean up modeling of strcmp, including cases where a string ↵Jordy Rose2011-06-161-41/+85
| | | | | | literal has an embedded null character, and where both arguments are the same buffer. Also use nested ifs rather than early returns; in this case early returns will lose any assumptions we've made earlier in the function. llvm-svn: 133154
* [analyzer] Fix trivial errors in previous commit.Jordy Rose2011-06-161-2/+3
| | | | | | | | I will not commit without building first. I will not commit without building first. I will not commit without building first... llvm-svn: 133150
* [analyzer] Cleanup: mainly 80-char violations and preferring ↵Jordy Rose2011-06-161-9/+12
| | | | | | SValBuilder::getComparisonType() to just referencing IntTy. llvm-svn: 133149
OpenPOWER on IntegriCloud