summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer] Buffers passed to CGBitmapContextCreate can escape.Jordan Rose2012-06-161-5/+7
| | | | | | | | | | | | | | Specifically, although the bitmap context does not take ownership of the buffer (unlike CGBitmapContextCreateWithData), the data buffer can be extracted out of the created CGContextRef. Thus the buffer is not leaked even if its original pointer goes out of scope, as long as - the context escapes, or - it is retrieved via CGBitmapContextGetData and freed. Actually implementing that logic is beyond the current scope of MallocChecker, so for now CGBitmapContextCreate goes on our system function exception list. llvm-svn: 158579
* [analyzer] Anti-aliasing: different heap allocations do not aliasAnna Zaks2012-06-071-5/+13
| | | | | | | | | | | | Add a concept of symbolic memory region belonging to heap memory space. When comparing symbolic regions allocated on the heap, assume that they do not alias. Use symbolic heap region to suppress a common false positive pattern in the malloc checker, in code that relies on malloc not returning the memory aliased to other malloc allocations, stack. llvm-svn: 158136
* Fix typos found by http://github.com/lyda/misspell-checkBenjamin Kramer2012-06-021-2/+2
| | | | llvm-svn: 157886
* [analyzer] Malloc checker: remove unnecessary comparisons.Anna Zaks2012-05-181-16/+10
| | | | llvm-svn: 157081
* [analyzer]Malloc: refactor and report use after free by memoryAnna Zaks2012-05-181-10/+57
| | | | | | allocating functions. llvm-svn: 157037
* [analyzer] Do not highlight the range of the statement in case of leak.Anna Zaks2012-05-101-8/+24
| | | | | | | | | | We report a leak at a point a leaked variable is no longer accessible. The statement that happens to be at that point is not relevant to the leak diagnostic and, thus, should not be highlighted. radar://11178519 llvm-svn: 156530
* [analyzer] Allow pointers escape through calls containing callback args.Anna Zaks2012-05-031-0/+10
| | | | | | | (Since we don't have a generic pointer escape callback, modify ExprEngineCallAndReturn as well as the malloc checker.) llvm-svn: 156134
* [analyzer] Fix the 'ptr = ptr' false negative in the Malloc checker.Anna Zaks2012-05-021-1/+16
| | | | llvm-svn: 155963
* [analyzer] Don't crash even when the system functions are redefined.Anna Zaks2012-04-101-0/+11
| | | | | | | | | | (Applied changes to CStringAPI, Malloc, and Taint.) This might almost never happen, but we should not crash even if it does. This fixes a crash on the internal analyzer buildbot, where postgresql's configure was redefining memmove (radar://11219852). llvm-svn: 154451
* [analyzer]Malloc,RetainRelease: Allow pointer to escape via NSMapInsert.Anna Zaks2012-03-301-0/+5
| | | | | | | | Fixes a false positive (radar://11152419). The current solution of adding the info into 3 places is quite ugly. Pending a generic pointer escapes callback. llvm-svn: 153731
* [analyzer] Malloc: Allow a pointer to escape through OSAtomicEnqueue.Anna Zaks2012-03-261-1/+2
| | | | llvm-svn: 153453
* [analyzer] Tighten up the realloc() failure path note generation...make sure ↵Jordy Rose2012-03-241-22/+31
| | | | | | we get the right realloc()! llvm-svn: 153370
* [analyzer] Restart path diagnostic generation if any of the visitors change ↵Jordy Rose2012-03-241-4/+0
| | | | | | | | | | the report configuration while walking the path. This required adding a change count token to BugReport, but also allowed us to ditch ImmutableList as the BugReporterVisitor data type. Also, remove the hack from MallocChecker, now that visitors appear in the opposite order. This is not exactly a fix, but the common case -- custom diagnostics after generic ones -- is now the default behavior. llvm-svn: 153369
* [analyzer] Add a clone() method to BugReporterVisitor, so that we'll be able ↵Jordy Rose2012-03-241-1/+1
| | | | | | to reset diagnostic generation. llvm-svn: 153368
* [analyzer] Malloc: drop symbols captured by blocks.Anna Zaks2012-03-221-0/+42
| | | | llvm-svn: 153232
* Remove unused variable, fix indentation.Benjamin Kramer2012-03-211-7/+5
| | | | llvm-svn: 153220
* [analyzer] Malloc: Utter the name of the leaked variable.Anna Zaks2012-03-211-10/+39
| | | | | | | | | | | | | | | Specifically, we use the last store of the leaked symbol in the leak diagnostic. (No support for struct fields since the malloc checker doesn't track those yet.) + Infrastructure to track the regions used in store evaluations. This approach is more precise than iterating the store to obtain the region bound to the symbol, which is used in RetainCount checker. The region corresponds to what is uttered in the code in the last store and we do not rely on the store implementation to support this functionality. llvm-svn: 153212
* [analyzer] Mark a failed-realloc's result as an interesting symbol between ↵Jordy Rose2012-03-181-3/+27
| | | | | | | | | | the realloc call and the null check, so we get nicer path notes. Fixes a regression introduced by the diagnostic pruning added in r152361. This is accomplished by calling markInteresting /during/ path diagnostic generation, and as such relies on deterministic ordering of BugReporterVisitors -- namely, that BugReporterVisitors are run in /reverse/ order from how they are added. (Right now that's a consequence of storing visitors in an ImmutableList, where new items are added to the front.) It's a little hacky, but it works for now. I think this is the best we can do without storing the relation between the old and new symbols, and that would be a hit whether or not there ends up being an error. llvm-svn: 153010
* [analyzer] Shorten the stack hint diagnostic.Anna Zaks2012-03-161-6/+9
| | | | | | | Do not display the standard "Returning from 'foo'", when a stack hint is available. llvm-svn: 152964
* [analyzer] Create symbol-aware stack hints (building upon r152837).Anna Zaks2012-03-161-7/+31
| | | | | | | | | | | | | | | | | | The symbol-aware stack hint combines the checker-provided message with the information about how the symbol was passed to the callee: as a parameter or a return value. For malloc, the generated messages look like this : "Returning from 'foo'; released memory via 1st parameter" "Returning from 'foo'; allocated memory via 1st parameter" "Returning from 'foo'; allocated memory returned" "Returning from 'foo'; reallocation of 1st parameter failed" (We are yet to handle cases when the symbol is a field in a struct or an array element.) llvm-svn: 152962
* [analyzer] Allow checkers to supply call stack diagnostic hints for theAnna Zaks2012-03-151-4/+11
| | | | | | | | | | | | | | | | | | | | | | | | | BugVisitor DiagnosticPieces. When checkers create a DiagnosticPieceEvent, they can supply an extra string, which will be concatenated with the call exit message for every call on the stack between the diagnostic event and the final bug report. (This is a simple version, which could be/will be further enhanced.) For example, this is used in Malloc checker to produce the ", which allocated memory" in the following example: static char *malloc_wrapper() { // 2. Entered call from 'use' return malloc(12); // 3. Memory is allocated } void use() { char *v; v = malloc_wrapper(); // 1. Calling 'malloc_wrappers' // 4. Returning from 'malloc_wrapper', which allocated memory } // 5. Memory is never released; potential memory leak llvm-svn: 152837
* [analyzer] Implement basic path diagnostic pruning based on "interesting" ↵Ted Kremenek2012-03-091-0/+4
| | | | | | | | | | | | | | | | | symbols and regions. Essentially, a bug centers around a story for various symbols and regions. We should only include the path diagnostic events that relate to those symbols and regions. The pruning is done by associating a set of interesting symbols and regions with a BugReporter, which can be modified at BugReport creation or by BugReporterVisitors. This patch reduces the diagnostics emitted in several of our test cases. I've vetted these as having desired behavior. The only regression is a missing null check diagnostic for the return value of realloc() in test/Analysis/malloc-plist.c. This will require some investigation to fix, and I have added a FIXME to the test case. llvm-svn: 152361
* [analyzer] Remove now-unused constant. No functionality change.Jordy Rose2012-03-061-2/+0
| | | | llvm-svn: 152080
* [analyzer] Fix unnecessary dyn_cast_or_null. No functionality change.Jordy Rose2012-03-061-2/+2
| | | | llvm-svn: 152078
* [analyzer] Malloc should assume that ownership is transfered whenAnna Zaks2012-03-051-1/+10
| | | | | | calling an ObjC method ending with 'NoCopy'. llvm-svn: 152037
* [analyzer] Fix a regression introduced in malloc withAnna Zaks2012-03-011-3/+7
| | | | | | | | | | attributes, introduced in r151188. + the test to catch it. Thanks to Ahmed Charles for pointing this out. llvm-svn: 151840
* [analyzer] Malloc: A pointer might escape through CFContainers APIs,Anna Zaks2012-02-291-3/+38
| | | | | | | | | | | | funopen, setvbuf. Teach the checker and the engine about these APIs to resolve malloc false positives. As I am adding more of these APIs, it is clear that all this should be factored out into a separate callback (for example, region escapes). Malloc, KeyChainAPI and RetainRelease checkers could all use it. llvm-svn: 151737
* [analyzer] Fix Malloc False Positive (PR 12100)Anna Zaks2012-02-281-5/+23
| | | | | | | | When allocated buffer is passed to CF/NS..NoCopy functions, the ownership is transfered unless the deallocator argument is set to 'kCFAllocatorNull'. llvm-svn: 151608
* [analyzer] Leaks should be uniqued by the allocation point in theAnna Zaks2012-02-271-6/+13
| | | | | | | | | closest function context. This prevents us from uniqueing all leaks from the same allocation helper. radar://10932226 llvm-svn: 151592
* [analyzer] Malloc: reason about the ObjC messages and C++.Anna Zaks2012-02-241-20/+56
| | | | | | | | | | | Assume none of the ObjC messages defined in system headers free memory, except for the ones containing 'freeWhenDone' selector. Currently, just assume that the region escapes to the messages with 'freeWhenDone' (ideally, we want to treat it as 'free()'). For now, always assume that regions escape when passed to C++ methods. llvm-svn: 151410
* [analyzer] Malloc: unique leak reports by allocation site.Anna Zaks2012-02-231-3/+37
| | | | | | | | | When we find two leak reports with the same allocation site, report only one of them. Provide a helper method to BugReporter to facilitate this. llvm-svn: 151287
* [analyzer] Invalidate the region passed to pthread_setspecific() call.Anna Zaks2012-02-231-2/+12
| | | | | | | | | | | | | | | | | | Make this call an exception in ExprEngine::invalidateArguments: 'int pthread_setspecific(ptheread_key k, const void *)' stores a value into thread local storage. The value can later be retrieved with 'void *ptheread_getspecific(pthread_key)'. So even thought the parameter is 'const void *', the region escapes through the call. (Here we just blacklist the call in the ExprEngine's default logic. Another option would be to add a checker which evaluates the call and triggers the call to invalidate regions.) Teach the Malloc Checker, which treats all system calls as safe about the API. llvm-svn: 151220
* [analyzer] Malloc cleanup:Anna Zaks2012-02-221-99/+82
| | | | | | | | | | | | - We should not evaluate strdup in the Malloc Checker, it's the job of CString checker, so just update the RefState to reflect allocated memory. - Refactor to reduce LOC: remove some wrapper auxiliary functions, make all functions return the state and add the transition in one place (instead of in each auxiliary function). llvm-svn: 151188
* [analyzer] Malloc checker: mark 'strdup' and 'strndup' as allocators.Anna Zaks2012-02-221-20/+42
| | | | llvm-svn: 151124
* [analyzer] Malloc: fix another false positive.Anna Zaks2012-02-221-1/+11
| | | | | | | , when we return a symbol reachable to the malloced one via pointer arithmetic. llvm-svn: 151121
* [analyzer] Make Malloc aware of inter-procedural execution + basicAnna Zaks2012-02-201-2/+7
| | | | | | tests. llvm-svn: 150993
* [analyzer] Fix another false positive in the Malloc Checker, by makingAnna Zaks2012-02-171-0/+2
| | | | | | | | | | | | it aware of CString APIs that return the input parameter. Malloc Checker needs to know how the 'strcpy' function is evaluated. Introduce the dependency on CStringChecker for that. CStringChecker knows all about these APIs. Addresses radar://10864450 llvm-svn: 150846
* [analyzer] Malloc Checker: Clean up bug naming:Anna Zaks2012-02-161-15/+13
| | | | | | | - Rename the category "Logic Error" -> "Memory Error". - Shorten all the messages. llvm-svn: 150733
* [analyzer] Malloc Checker: Make the diagnostic visitor handle the caseAnna Zaks2012-02-161-22/+74
| | | | | | of failing realloc. + Minor cleanups. llvm-svn: 150732
* [analyzer] Malloc Checker: Give up when a pointer escapes into a struct.Anna Zaks2012-02-161-0/+6
| | | | | | | | We are not properly handling the memory regions that escape into struct fields, which led to a bunch of false positives. Be conservative here and give up when a pointer escapes into a struct. llvm-svn: 150658
* [analyzer] Malloc checker: make a bit safer.Anna Zaks2012-02-151-2/+6
| | | | llvm-svn: 150556
* [analyzer] Malloc Checker: add support for reallocf, which always freesAnna Zaks2012-02-151-22/+44
| | | | | | the passed in pointer on failure. llvm-svn: 150533
* [analyzer] Malloc Checker: add support for valloc + minor codeAnna Zaks2012-02-151-12/+19
| | | | | | hardening. llvm-svn: 150532
* [analyzer] Make Malloc Checker optimistic in presence of inlining.Anna Zaks2012-02-141-53/+100
| | | | | | | | | | | | (In response of Ted's review of r150112.) This moves the logic which checked if a symbol escapes through a parameter to invalidateRegionCallback (instead of post CallExpr visit.) To accommodate the change, added a CallOrObjCMessage parameter to checkRegionChanges callback. llvm-svn: 150513
* [analyzer] Malloc Checker: realloc: add dependency between the symbolsAnna Zaks2012-02-141-9/+6
| | | | | | | | | | | | | in realloc map. If there is no dependency, the reallocated ptr will get garbage collected before we know that realloc failed, which would lead us to missing a memory leak warning. Also added new test cases, which we can handle now. Plus minor cleanups. llvm-svn: 150446
* [analyzer] Malloc Checker: realloc: correct the way we are handing theAnna Zaks2012-02-131-8/+9
| | | | | | case when size is 0. llvm-svn: 150412
* [analyzer] Malloc checker: rework realloc handling:Anna Zaks2012-02-131-34/+80
| | | | | | | | | | | | | | | | | | | 1) Support the case when realloc fails to reduce False Positives. (We essentially need to restore the state of the pointer being reallocated.) 2) Realloc behaves differently under special conditions (from pointer is null, size is 0). When detecting these cases, we should consider under-constrained states (size might or might not be 0). The old version handled this in a very hacky way. The code did not differentiate between definite and possible (no consideration for under-constrained states). Further, after processing each special case, the realloc processing function did not return but chained to the next special case processing. So you could end up in an execution in which you first see the states in which size is 0 and realloc ~ free(), followed by the states corresponding to size is not 0 followed by the evaluation of the regular realloc behavior. llvm-svn: 150402
* [analyzer] Malloc Checker: reduce false negatives rate by assuming thatAnna Zaks2012-02-111-6/+28
| | | | | | | a pointer cannot escape through calls to system functions. Also, stop after reporting the first use-after-free. llvm-svn: 150315
* [analyzer] Malloc Checker: Report a leak when we are returning freedAnna Zaks2012-02-111-0/+6
| | | | | | | | | memory. (As per one test case, the existing checker thought that this could cause a lot of false positives - not sure if that's valid, to be verified.) llvm-svn: 150313
* [analyzer] Malloc checker: Leak bugs should be suppressed by sinks.Anna Zaks2012-02-111-18/+28
| | | | | | | Resolves a common false positive, where we were reporting a leak inside asserts llvm-svn: 150312
OpenPOWER on IntegriCloud