summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer] Eliminates all the cases with unknown family.Anton Yartsev2013-04-051-6/+7
| | | | | | Now treat AF_None family as impossible in isTrackedFamily() llvm-svn: 178899
* [analyzer] Split new/delete checker into use-after-free and leaks parts.Jordan Rose2013-04-051-2/+13
| | | | | | | | | | | | This splits the leak-checking part of alpha.cplusplus.NewDelete into a separate user-level checker, alpha.cplusplus.NewDeleteLeaks. All the difficult false positives we've seen with the new/delete checker have been spurious leak warnings; the use-after-free warnings and mismatched deallocator warnings, while rare, have always been valid. <rdar://problem/6194569> llvm-svn: 178890
* [analyzer] Path notes for the MismatchedDeallocator checker.Anton Yartsev2013-04-051-4/+8
| | | | llvm-svn: 178862
* [analyzer] Check allocation family more precise.Anton Yartsev2013-04-051-4/+4
| | | | | | | | | The statement passed to isTrackedFamily() might be a user defined function calling malloc; in this case we got AF_NONE family for this function. Now the allocation family is derived from Sym, that holds a family of a real allocator. This commit is also a movement towards getting rid of tracking memory allocating by unknown means. llvm-svn: 178834
* [analyzer] Corrected the switch statement.Anton Yartsev2013-04-051-6/+3
| | | | llvm-svn: 178831
* [analyzer] Fully-covered switch for families in isTrackedFamily()Anton Yartsev2013-04-051-7/+18
| | | | llvm-svn: 178820
* [analyzer] Reduced the unwanted correlations between checkers living inside ↵Anton Yartsev2013-04-041-89/+137
| | | | | | | | | | | | | MallocChecker.cpp This fixes an issue pointed to by Jordan: if unix.Malloc and unix.MismatchedDeallocator are both on, then we end up still tracking leaks of memory allocated by new. Moved the guards right before emitting the bug reports to unify and simplify the logic of handling of multiple checkers. Now all the checkers perform their checks regardless of if they were enabled, or not, and it is decided just before the emitting of the report, if it should be emitted. (idea from Anna). Additional changes: improved test coverage for checker correlations; refactoring: BadDealloc -> MismatchedDealloc llvm-svn: 178814
* [analyzer] Add support for escape of const pointers and use it to allow ↵Anna Zaks2013-03-281-3/+40
| | | | | | | | | | | | | “newed” pointers to escape Add a new callback that notifies checkers when a const pointer escapes. Currently, this only works for const pointers passed as a top level parameter into a function. We need to differentiate the const pointers escape from regular escape since the content pointed by const pointer will not change; if it’s a file handle, a file cannot be closed; but delete is allowed on const pointers. This should suppress several false positives reported by the NewDelete checker on llvm codebase. llvm-svn: 178310
* Fix order of initialization warning.Eric Christopher2013-03-281-1/+1
| | | | llvm-svn: 178255
* [analyzer] These implements unix.MismatchedDeallocatorChecker checker.Anton Yartsev2013-03-281-74/+297
| | | | | | | | + Improved display names for allocators and deallocators The checker checks if a deallocation function matches allocation one. ('free' for 'malloc', 'delete' for 'new' etc.) llvm-svn: 178250
* [analyzer] For now assume all standard global 'operator new' functions ↵Anton Yartsev2013-03-281-3/+6
| | | | | | | | allocate memory in heap. + Improved test coverage for cplusplus.NewDelete checker. llvm-svn: 178244
* [analyzer] Adds cplusplus.NewDelete checker that check for memory leaks, ↵Anton Yartsev2013-03-251-25/+134
| | | | | | double free, and use-after-free problems of memory managed by new/delete. llvm-svn: 177849
* [analyzer] fixed the logic changed by r176949Anton Yartsev2013-03-131-4/+5
| | | | llvm-svn: 176956
* Refactoring:Anton Yartsev2013-03-131-34/+55
| | | | | | | | | + Individual Report* method for each bug type + Comment improved: missing non-trivial alloca() case annotated + 'range' parameter of ReportBadFree() capitalized + 'SymbolRef Sym = State->getSVal(A, C.getLocationContext()).getAsSymbol();' shorten to 'SymbolRef Sym = C.getSVal(A).getAsSymbol();' llvm-svn: 176949
* [analyzer] Be more consistent about Objective-C methods that free memory.Jordan Rose2013-03-091-54/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, MallocChecker's pointer escape check and its post-call state update for Objective-C method calls had a fair amount duplicated logic and not-entirely-consistent checks. This commit restructures all this to be more consistent and possibly allow us to be more aggressive in warning about double-frees. New policy (applies to system header methods only): (1) If this is a method we know about, model it as taking/holding ownership of the passed-in buffer. (1a) ...unless there's a "freeWhenDone:" parameter with a zero (NO) value. (2) If there's a "freeWhenDone:" parameter (but it's not a method we know about), treat the buffer as escaping if the value is non-zero (YES) and non-escaping if it's zero (NO). (3) If the first selector piece ends with "NoCopy" (but it's not a method we know about and there's no "freeWhenDone:" parameter), treat the buffer as escaping. The reason that (2) and (3) don't explicitly model the ownership transfer is because we can't be sure that they will actually free the memory using free(), and we wouldn't want to emit a spurious "mismatched allocator" warning (coming in Anton's upcoming patch). In the future, we may have an idea of a "generic deallocation", i.e. we assume that the deallocator is correct but still continue tracking the region so that we can warn about double-frees. Patch by Anton Yartsev, with modifications from me. llvm-svn: 176744
* Replace ProgramPoint llvm::cast support to be well-defined.David Blaikie2013-02-211-5/+5
| | | | | | See r175462 for another example/more details. llvm-svn: 175812
* Include llvm::Optional in clang/Basic/LLVM.hDavid Blaikie2013-02-201-6/+4
| | | | | | Post-commit CR feedback from Jordan Rose regarding r175594. llvm-svn: 175679
* Replace SVal llvm::cast support to be well-defined.David Blaikie2013-02-201-17/+19
| | | | | | See r175462 for another example/more details. llvm-svn: 175594
* [analyzer] Report bugs when freeing memory with offset pointerAnna Zaks2013-02-071-20/+71
| | | | | | | | | | | | | | | | | The malloc checker will now catch the case when a previously malloc'ed region is freed, but the pointer passed to free does not point to the start of the allocated memory. For example: int *p1 = malloc(sizeof(int)); p1++; free(p1); // warn From the "memory.LeakPtrValChanged enhancement to unix.Malloc" entry in the list of potential checkers. A patch by Branden Archer! llvm-svn: 174678
* [analyzer] Add pointer escape type param to checkPointerEscape callbackAnna Zaks2013-02-071-3/+8
| | | | | | | | | | | | | | The checkPointerEscape callback previously did not specify how a pointer escaped. This change includes an enum which describes the different ways a pointer may escape. This enum is passed to the checkPointerEscape callback when a pointer escapes. If the escape is due to a function call, the call is passed. This changes previous behavior where the call is passed as NULL if the escape was due to indirectly invalidating the region the pointer referenced. A patch by Branden Archer! llvm-svn: 174677
* Remove useless 'llvm::' qualifier from names like StringRef and others that areDmitri Gribenko2013-01-121-3/+3
| | | | | | brought into 'clang' namespace by clang/Basic/LLVM.h llvm-svn: 172323
* [analyzer] Include the bug uniqueing location in the issue_hash.Anna Zaks2013-01-081-15/+18
| | | | | | | | | | | | | | | The issue here is that if we have 2 leaks reported at the same line for which we cannot print the corresponding region info, they will get treated as the same by issue_hash+description. We need to AUGMENT the issue_hash with the allocation info to differentiate the two issues. Add the "hash" (offset from the beginning of a function) representing allocation site to solve the issue. We might want to generalize solution in the future when we decide to track more than just the 2 locations from the diagnostics. llvm-svn: 171825
* Tighten code. No functionality change.Ted Kremenek2013-01-041-7/+7
| | | | llvm-svn: 171501
* Make MallocChecker debug output useful.Ted Kremenek2013-01-031-2/+22
| | | | llvm-svn: 171439
* [analyzer] Add the pointer escaped callback.Anna Zaks2012-12-201-89/+16
| | | | | | | | | | Instead of using several callbacks to identify the pointer escape event, checkers now can register for the checkPointerEscape. Converted the Malloc checker to use the new callback. SimpleStreamChecker will be converted next. llvm-svn: 170625
* [analyzer] Don't generate a summary for "freeWhenDone" if method isAnna Zaks2012-12-111-0/+3
| | | | | | | | | inlined. Fixes a false positive that occurs if a user writes their own initWithBytesNoCopy:freeWhenDone wrapper. llvm-svn: 169795
* Only provide explicit getCapturedRegion() and getOriginalRegion() from ↵Ted Kremenek2012-12-061-1/+1
| | | | | | | | referenced_vars_iterator. This is a nice conceptual cleanup. llvm-svn: 169480
* Sort all of Clang's files under 'lib', and fix up the broken headersChandler Carruth2012-12-041-4/+4
| | | | | | | | | | | | | uncovered. This required manually correcting all of the incorrect main-module headers I could find, and running the new llvm/utils/sort_includes.py script over the files. I also manually added quite a few missing headers that were uncovered by shuffling the order or moving headers up to be main-module-headers. llvm-svn: 169237
* Pull the Attr iteration parts out of Attr.h, so including DeclBase.h doesn't ↵Benjamin Kramer2012-12-011-1/+2
| | | | | | | | | pull in all the generated Attr code. Required to pull some functions out of line, but this shouldn't have a perf impact. No functionality change. llvm-svn: 169092
* Make helpers static/anonymous.Benjamin Kramer2012-11-221-2/+2
| | | | llvm-svn: 168500
* [analyzer] MallocChecker: Remove now-unnecessary check::EndPath callback.Jordan Rose2012-11-151-29/+1
| | | | | | | Also, don't bother to stop tracking symbols in the return value, either. They are now properly considered live during checkDeadSymbols. llvm-svn: 168067
* [analyzer] Address Jordan's code review for r167813.Anna Zaks2012-11-131-20/+15
| | | | | | | This simplifies logic, fixes a bug, and adds a test case. Thanks Jordan! llvm-svn: 167868
* Fix a Malloc Checker FP by tracking return values from initWithCharacterAnna Zaks2012-11-131-20/+81
| | | | | | | | | | and other functions. When these functions return null, the pointer is not freed by them/ownership is not transfered. So we should allow the user to free the pointer by calling another function when the return value is NULL. llvm-svn: 167813
* [analyzer] Use nice macros for the common ProgramStateTraits (map, set, list).Jordan Rose2012-11-021-26/+9
| | | | | | | | | Also, move the REGISTER_*_WITH_PROGRAMSTATE macros to ProgramStateTrait.h. This doesn't get rid of /all/ explicit uses of ProgramStatePartialTrait, but it does get a lot of them. llvm-svn: 167276
* [analyzer] Rename 'EmitReport' to 'emitReport'.Jordan Rose2012-11-021-4/+4
| | | | | | No functionality change. llvm-svn: 167275
* [analyzer] Fix typo in r167186.Jordan Rose2012-11-011-1/+1
| | | | llvm-svn: 167189
* [analyzer] Rename ConditionTruthVal::isTrue to isConstrainedTrue.Jordan Rose2012-11-011-2/+7
| | | | | | | | (and the same for isFalse) No functionality change. llvm-svn: 167186
* [analyzer] Malloc checker cleanup/refactorAnna Zaks2012-10-291-9/+7
| | | | | | | No need for the auxiliary flag. No need to generate a leak node when there is no error. llvm-svn: 166977
* Use llvm::getOrdinalSuffix to print ordinal numbers in diagnostics.Jordan Rose2012-09-221-4/+6
| | | | | | Just a refactoring of common infrastructure. No intended functionality change. llvm-svn: 164443
* [analyzer] MallocChecker should not do post-call checks on inlined functions.Jordan Rose2012-09-201-0/+3
| | | | | | | | | | | If someone provides their own function called 'strdup', or 'reallocf', or even 'malloc', and we inlined it, the inlining should have given us all the malloc-related information we need. If we then try to attach new information to the return value, we could end up with spurious warnings. <rdar://problem/12317671> llvm-svn: 164276
* [analyzer] Teach the analyzer about implicit initialization of staticsAnna Zaks2012-09-171-1/+1
| | | | | | | | | | | in ObjCMethods. Extend FunctionTextRegion to represent ObjC methods as well as functions. Note, it is not clear what type ObjCMethod region should return. Since the type of the FunctionText region is not currently used, defer solving this issue. llvm-svn: 164046
* [analyzer] Fix another false positive in malloc realloc logic.Anna Zaks2012-09-121-13/+32
| | | | llvm-svn: 163749
* Remove ProgramState::getSymVal(). It was being misused by Checkers,Ted Kremenek2012-09-071-8/+5
| | | | | | | | | | | | | | | | | | | | with at least one subtle bug in MacOSXKeyChainAPIChecker where the calling the method was a substitute for assuming a symbolic value was null (which is not the case). We still keep ConstraintManager::getSymVal(), but we use that as an optimization in SValBuilder and ProgramState::getSVal() to constant-fold SVals. This is only if the ConstraintManager can provide us with that information, which is no longer a requirement. As part of this, introduce a default implementation of ConstraintManager::getSymVal() which returns null. For Checkers, introduce ConstraintManager::isNull(), which queries the state to see if the symbolic value is constrained to be a null value. It does this without assuming it has been implicitly constant folded. llvm-svn: 163428
* [analyzer] Fix realloc related bug in the malloc checker.Anna Zaks2012-08-241-12/+38
| | | | | | | When reallocation of a non-allocated (not owned) symbol fails do not expect it to be freed. llvm-svn: 162533
* Rename 'currentX' to 'currX' throughout analyzer and libAnalysis.Ted Kremenek2012-08-221-1/+1
| | | | | | | | | Also rename 'getCurrentBlockCounter()' to 'blockCount()'. This ripples a bunch of code simplifications; mostly aesthetic, but makes the code a bit tighter. llvm-svn: 162349
* [analyzer] Cleanup of malloc checker.Anna Zaks2012-08-091-22/+1
| | | | | | | Remove Escaped state, which is not really necessary. We can just stop tracking the symbol instead of keeping it around and marking escaped. llvm-svn: 161557
* [analyzer] Clean up the printing of FieldRegions for leaks.Jordan Rose2012-08-081-3/+2
| | | | | | | | | | | | | | Unfortunately, generalized region printing is very difficult: - ElementRegions are used both for casting and as actual elements. - Accessing values through a pointer means going through an intermediate SymbolRegionValue; symbolic regions are untyped. - Referring to implicitly-defined variables like 'this' and 'self' could be very confusing if they come from another stack frame. We fall back to simply not printing the region name if we can't be sure it will print well. This will allow us to improve in the future. llvm-svn: 161512
* [analyzer] Track malloc'd regions stored in structs.Jordan Rose2012-08-081-16/+14
| | | | | | | | | | | The main blocker on this (besides the previous commit) was that ScanReachableSymbols was not looking through LazyCompoundVals. Once that was fixed, it's easy enough to clear out malloc data on return, just like we do when we bind to a global region. <rdar://problem/10872635> llvm-svn: 161511
* [analyzer] Malloc: remove assert since is not valid as of r161248Anna Zaks2012-08-041-5/+0
| | | | | | | We can be in the situation where we did not track the symbol before realloc was called on it. llvm-svn: 161294
* [analyzer] Malloc: track non-allocated but freed memoryAnna Zaks2012-08-031-12/+4
| | | | | | | | | | There is no reason why we should not track the memory which was not allocated in the current function, but was freed there. This would allow to catch more use-after-free and double free with no/limited IPA. Also fix a realloc issue which surfaced as the result of this patch. llvm-svn: 161248
OpenPOWER on IntegriCloud