summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Checkers
Commit message (Collapse)AuthorAgeFilesLines
* [analyzer] Don't delete TaintConfig copy constructorAlex Langford2019-08-141-2/+2
| | | | | | | | | | | | | | | | | | | | | Summary: Explicitly deleting the copy constructor makes compiling the function `ento::registerGenericTaintChecker` difficult with some compilers. When we construct an `llvm::Optional<TaintConfig>`, the optional is constructed with a const TaintConfig reference which it then uses to invoke the deleted TaintConfig copy constructor. I've observered this failing with clang 3.8 on Ubuntu 16.04. Reviewers: compnerd, Szelethus, boga95, NoQ, alexshap Subscribers: xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, Charusso, llvm-commits, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D66192 llvm-svn: 368779
* [analyzer][NFC] Prepare visitors for different tracking kindsKristof Umann2019-08-143-4/+6
| | | | | | | | | | | | | | | | | | | | | | | When we're tracking a variable that is responsible for a null pointer dereference or some other sinister programming error, we of course would like to gather as much information why we think that the variable has that specific value as possible. However, the newly introduced condition tracking shows that tracking all values this thoroughly could easily cause an intolerable growth in the bug report's length. There are a variety of heuristics we discussed on the mailing list[1] to combat this, all of them requiring to differentiate in between tracking a "regular value" and a "condition". This patch introduces the new `bugreporter::TrackingKind` enum, adds it to several visitors as a non-optional argument, and moves some functions around to make the code a little more coherent. [1] http://lists.llvm.org/pipermail/cfe-dev/2019-June/062613.html Differential Revision: https://reviews.llvm.org/D64270 llvm-svn: 368777
* [analyzer][NFC] Make sure that the BugReport is not modified during the ↵Kristof Umann2019-08-131-1/+1
| | | | | | | | | | | | construction of non-visitor pieces I feel this is kinda important, because in a followup patch I'm adding different kinds of interestingness, and propagating the correct kind in BugReporter.cpp is just one less thing to worry about. Differential Revision: https://reviews.llvm.org/D65578 llvm-svn: 368755
* [analyzer][NFC] Refactoring BugReporter.cpp P4.: If it can be const, make it ↵Kristof Umann2019-08-134-5/+5
| | | | | | | | | | | | | | const When I'm new to a file/codebase, I personally find C++'s strong static type system to be a great aid. BugReporter.cpp is still painful to read however: function calls are made with mile long parameter lists, seemingly all of them taken with a non-const reference/pointer. This patch fixes nothing but this: make a few things const, and hammer it until it compiles. Differential Revision: https://reviews.llvm.org/D65382 llvm-svn: 368735
* [analyzer][NFC] Refactoring BugReporter.cpp P3.: ↵Kristof Umann2019-08-1318-120/+104
| | | | | | | | | | | | | std::shared_pointer<PathDiagnosticPiece> -> PathDiagnosticPieceRef find clang/ -type f -exec sed -i 's/std::shared_ptr<PathDiagnosticPiece>/PathDiagnosticPieceRef/g' {} \; git diff -U3 --no-color HEAD^ | clang-format-diff-6.0 -p1 -i Just as C++ is meant to be refactored, right? Differential Revision: https://reviews.llvm.org/D65381 llvm-svn: 368717
* [analyzer] CastValueChecker: Model castAs(), getAs()Csaba Dabis2019-08-091-91/+161
| | | | | | | | | | Summary: Thanks to Kristóf Umann for the great idea! Reviewed By: NoQ Differential Revision: https://reviews.llvm.org/D65889 llvm-svn: 368383
* [Analyzer] Iterator Checkers - Fix for Crash on Iterator DifferencesAdam Balogh2019-08-051-4/+8
| | | | | | | Iterators differences were mistakenly handled as random decrements which causes an assertion. This patch fixes this. llvm-svn: 367802
* Buildbot fix for r367190Gabor Borsik2019-07-281-1/+1
| | | | llvm-svn: 367193
* [analyzer] Add yaml parser to GenericTaintCheckerGabor Borsik2019-07-282-22/+215
| | | | | | | | | | | | | | | | | | | | | While we implemented taint propagation rules for several builtin/standard functions, there's a natural desire for users to add such rules to custom functions. A series of patches will implement an option that allows users to annotate their functions with taint propagation rules through a YAML file. This one adds parsing of the configuration file, which may be specified in the commands line with the analyzer config: alpha.security.taint.TaintPropagation:Config. The configuration may contain propagation rules, filter functions (remove taint) and sink functions (give a warning if it gets a tainted value). I also added a new header for future checkers to conveniently read YAML files as checker options. Differential Revision: https://reviews.llvm.org/D59555 llvm-svn: 367190
* [analyzer] MallocChecker: Prevent Integer Set Library false positivesCsaba Dabis2019-07-181-1/+38
| | | | | | | | | | | | | | Summary: Integer Set Library using retain-count based allocation which is not modeled in MallocChecker. Reviewed By: NoQ Tags: #clang Differential Revision: https://reviews.llvm.org/D64680 llvm-svn: 366391
* Fix parameter name comments using clang-tidy. NFC.Rui Ueyama2019-07-1611-14/+14
| | | | | | | | | | | | | | | | | | | | | This patch applies clang-tidy's bugprone-argument-comment tool to LLVM, clang and lld source trees. Here is how I created this patch: $ git clone https://github.com/llvm/llvm-project.git $ cd llvm-project $ mkdir build $ cd build $ cmake -GNinja -DCMAKE_BUILD_TYPE=Debug \ -DLLVM_ENABLE_PROJECTS='clang;lld;clang-tools-extra' \ -DCMAKE_EXPORT_COMPILE_COMMANDS=On -DLLVM_ENABLE_LLD=On \ -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ ../llvm $ ninja $ parallel clang-tidy -checks='-*,bugprone-argument-comment' \ -config='{CheckOptions: [{key: StrictMode, value: 1}]}' -fix \ ::: ../llvm/lib/**/*.{cpp,h} ../clang/lib/**/*.{cpp,h} ../lld/**/*.{cpp,h} llvm-svn: 366177
* Delete dead storesFangrui Song2019-07-121-2/+1
| | | | llvm-svn: 365901
* [analyzer] CastValueChecker: Remove a dump()Csaba Dabis2019-07-101-1/+0
| | | | | Summary: Fix a nit. llvm-svn: 365590
* [analyzer] CastValueChecker: Model castsCsaba Dabis2019-07-102-0/+192
| | | | | | | | | | | | | | | | | | | | | Summary: It models the LLVM casts: - `cast<>` - `dyn_cast<>` - `cast_or_null<>` - `dyn_cast_or_null<>` It has a very basic support without checking the `classof()` function. (It reapplies the reverted 'llvm-svn: 365582' patch with proper test file.) Reviewed By: NoQ Tags: #clang Differential Revision: https://reviews.llvm.org/D64374 llvm-svn: 365585
* Revert "[analyzer] CastValueChecker: Model casts"Csaba Dabis2019-07-092-191/+0
| | | | | | This reverts commit 27cf6664437efd640bb6db5594bafcce68fa2854. llvm-svn: 365584
* [analyzer] CastValueChecker: Model castsCsaba Dabis2019-07-092-0/+191
| | | | | | | | | | | | | | | | | | | Summary: It models the LLVM casts: - `cast<>` - `dyn_cast<>` - `cast_or_null<>` - `dyn_cast_or_null<>` It has a very basic support without checking the `classof()` function. Reviewed By: NoQ Tags: #clang Differential Revision: https://reviews.llvm.org/D64374 llvm-svn: 365582
* [analyzer][IDF] Add a control dependency calculator + a new debug checkerKristof Umann2019-07-051-6/+31
| | | | | | | | | | | | | | | | | | | | | | | I intend to improve the analyzer's bug reports by tracking condition expressions. 01 bool b = messyComputation(); 02 int i = 0; 03 if (b) // control dependency of the bug site, let's explain why we assume val 04 // to be true 05 10 / i; // warn: division by zero I'll detail this heuristic in the followup patch, strictly related to this one however: * Create the new ControlDependencyCalculator class that uses llvm::IDFCalculator to (lazily) calculate control dependencies for Clang's CFG. * A new debug checker debug.DumpControlDependencies is added for lit tests * Add unittests Differential Revision: https://reviews.llvm.org/D62619 llvm-svn: 365197
* [analyzer] ReturnValueChecker: Model the guaranteed boolean return value of ↵Csaba Dabis2019-07-042-0/+171
| | | | | | | | | | | | | | | | | | | function calls Summary: It models the known LLVM methods paired with their class. Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus Reviewed By: NoQ Subscribers: dschuff, aheejin, mgorny, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D63915 llvm-svn: 365103
* [analyzer][Dominator] Add post dominators to CFG + a new debug checkerKristof Umann2019-07-031-2/+28
| | | | | | | | | | | | | | | | Transform clang::DominatorTree to be able to also calculate post dominators. * Tidy up the documentation * Make it clang::DominatorTree template class (similarly to how llvm::DominatorTreeBase works), rename it to clang::CFGDominatorTreeImpl * Clang's dominator tree is now called clang::CFGDomTree * Clang's brand new post dominator tree is called clang::CFGPostDomTree * Add a lot of asserts to the dump() function * Create a new checker to test the functionality Differential Revision: https://reviews.llvm.org/D62551 llvm-svn: 365028
* Change std::{lower,upper}_bound to llvm::{lower,upper}_bound or ↵Fangrui Song2019-07-031-4/+2
| | | | | | llvm::partition_point. NFC llvm-svn: 365006
* [analyzer] Support kfree in MallocCheckerNathan Huckleberry2019-07-011-12/+14
| | | | | | | | | | | | | | | | | | | Summary: kmalloc is freed with kfree in the linux kernel. kmalloc support was added in r204832, but kfree was not. Adding kfree fixes incorrectly detected memory leaks. Reviewers: NoQ, nickdesaulniers, dcoughlin, Szelethus Reviewed By: NoQ, Szelethus Subscribers: xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, Charusso, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D64030 llvm-svn: 364875
* [analyzer] NonnullGlobalConstants: Don't be confused by a _Nonnull attribute.Artem Dergachev2019-07-011-8/+15
| | | | | | | | | | | | | | | The NonnullGlobalConstants checker models the rule "it doesn't make sense to make a constant global pointer and initialize it to null"; it makes sure that whatever it's initialized with is known to be non-null. Ironically, annotating the type of the pointer as _Nonnull breaks the checker. Fix handling of the _Nonnull annotation so that it was instead one more reason to believe that the value is non-null. Differential Revision: https://reviews.llvm.org/D63956 llvm-svn: 364869
* [analyzer] CStringChecker: Modernize to use CallDescriptions.Artem Dergachev2019-07-011-147/+58
| | | | | | | | | | | | | This patch uses the new CDF_MaybeBuiltin flag to handle C library functions. It's mostly an NFC/refactoring pass, but it does fix a bug in handling memset() when it expands to __builtin___memset_chk() because the latter has one more argument and memset() handling code was trying to match the exact number of arguments. Now the code is deduplicated and there's less room for mistakes. Differential Revision: https://reviews.llvm.org/D62557 llvm-svn: 364868
* [analyzer] DeadStores: Update the crude suppression for files generated by IIG.Artem Dergachev2019-06-201-1/+1
| | | | | | They changed the comments that we were looking for. llvm-svn: 363995
* [analyzer] NFC: Change evalCall() to provide a CallEvent.Artem Dergachev2019-06-199-78/+84
| | | | | | | | | | | | This changes the checker callback signature to use the modern, easy to use interface. Additionally, this unblocks future work on allowing checkers to implement evalCall() for calls that don't correspond to any call-expression or require additional information that's only available as part of the CallEvent, such as C++ constructors and destructors. Differential Revision: https://reviews.llvm.org/D62440 llvm-svn: 363893
* [analyzer] DeadStores: Add a crude suppression files generated by DriverKit IIG.Artem Dergachev2019-06-191-0/+23
| | | | | | | | | | | | IIG is a replacement for MIG in DriverKit: IIG is autogenerating C++ code. Suppress dead store warnings on such code, as the tool seems to be producing them regularly, and the users of IIG are not in position to address these warnings, as they don't control the autogenerated code. IIG-generated code is identified by looking at the comments at the top of the file. Differential Revision: https://reviews.llvm.org/D63118 llvm-svn: 363892
* [analyzer] print() JSONify: Type information implementationCsaba Dabis2019-05-291-2/+2
| | | | | | | | | | | | | | | | | Summary: - Reviewers: NoQ, xazax.hun, ravikandhadai, baloghadamsoftware, Szelethus Reviewed By: NoQ Subscribers: szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp Tags: #clang Differential Revision: https://reviews.llvm.org/D62083 llvm-svn: 361979
* [Analyzer] Replace `CXXSelfAssignmentBRVisitor` with `NoteTags`Adam Balogh2019-05-281-2/+18
| | | | | | | | | | | | The `cplusplus.SelfAssignment` checker has a visitor that is added to every `BugReport` to mark the to branch of the self assignment operator with e.g. `rhs == *this` and `rhs != *this`. With the new `NoteTag` feature this visitor is not needed anymore. Instead the checker itself marks the two branches using the `NoteTag`s. Differential Revision: https://reviews.llvm.org/D62479 llvm-svn: 361818
* [Analyzer] Checker for non-determinism caused by iteration of unordered ↵Mandeep Singh Grang2019-05-242-0/+101
| | | | | | | | | | | | | | | | | | container of pointers Summary: Added a checker for non-determinism caused by iterating unordered containers like std::unordered_set containing pointer elements. Reviewers: NoQ, george.karpenkov, whisperity, Szelethus, baloghadamsoftware Reviewed By: Szelethus Subscribers: mgorny, xazax.hun, baloghadamsoftware, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, jdoerfert, Charusso, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D59279 llvm-svn: 361664
* [CFG] NFC: Remove implicit conversion from CFGTerminator to Stmt *.Artem Dergachev2019-05-241-2/+2
| | | | | | | | | | | Turn it into a variant class instead. This conversion does indeed save some code but there's a plan to add support for more kinds of terminators that aren't necessarily based on statements, and with those in mind it becomes more and more confusing to have CFGTerminators implicitly convertible to a Stmt *. Differential Revision: https://reviews.llvm.org/D61814 llvm-svn: 361586
* [Analyzer] Refactor begin and end symbol creationAdam Balogh2019-05-201-22/+36
| | | | | | | | | | | | This patch refactors begin and end symbol creation by moving symbol conjuration into the `create...` functions. This way the functions' responsibilities are clearer and makes possible to add more functions handling these symbols (e.g. functions for handling the container's size) without code multiplication. Differential Revision: https://reviews.llvm.org/D61136 llvm-svn: 361141
* MIGChecker - assert we have a non-null LocationContext. NFCI.Simon Pilgrim2019-05-181-0/+2
| | | | | | Fixes scan-build warning. llvm-svn: 361097
* [analyzer] Remove the default value arg from getChecker*OptionKristof Umann2019-05-1711-24/+19
| | | | | | | | | | | | | | | | | | | Since D57922, the config table contains every checker option, and it's default value, so having it as an argument for getChecker*Option is redundant. By the time any of the getChecker*Option function is called, we verified the value in CheckerRegistry (after D57860), so we can confidently assert here, as any irregularities detected at this point must be a programmer error. However, in compatibility mode, verification won't happen, so the default value must be restored. This implies something else, other than adding removing one more potential point of failure -- debug.ConfigDumper will always contain valid values for checker/package options! Differential Revision: https://reviews.llvm.org/D59195 llvm-svn: 361042
* [analyzer] RetainCount: Fix os_returns_retained_on_zero with weird return types.Artem Dergachev2019-05-151-0/+5
| | | | | | | | | The checker was crashing when it was trying to assume a structure to be null or non-null so that to evaluate the effect of the annotation. Differential Revision: https://reviews.llvm.org/D61958 llvm-svn: 360790
* [analyzer] MIGChecker: Fix redundant semicolon.Artem Dergachev2019-05-151-1/+1
| | | | llvm-svn: 360739
* [analyzer] MIGChecker: Add support for os_ref_retain().Artem Dergachev2019-05-151-5/+28
| | | | | | | | | | Suppress MIG checker false positives that occur when the programmer increments the reference count before calling a MIG destructor, and the MIG destructor literally boils down to decrementing the reference count. Differential Revision: https://reviews.llvm.org/D61925 llvm-svn: 360737
* [c++20] Implement P1009R2: allow omitting the array bound in an arrayRichard Smith2019-05-061-2/+2
| | | | | | | | | | new expression. This was voted into C++20 as a defect report resolution, so we retroactively apply it to all prior language modes (though it can never actually be used before C++11 mode). llvm-svn: 360006
* [analyzer][UninitializedObjectChecker] PR41741: Regard all scalar types as ↵Kristof Umann2019-05-051-2/+1
| | | | | | | | | | | | | | | | | | | | primitive. https://bugs.llvm.org/show_bug.cgi?id=41741 Pretty much the same as D61246 and D61106, this time for __complex__ types. Upon further investigation, I realized that we should regard all types Type::isScalarType returns true for as primitive, so I merged isMemberPointerType(), isBlockPointerType() and isAnyComplexType()` into that instead. I also stumbled across yet another bug, https://bugs.llvm.org/show_bug.cgi?id=41753, but it seems to be unrelated to this checker. Differential Revision: https://reviews.llvm.org/D61569 llvm-svn: 359998
* [analyzer][UninitializedObjectChecker] PR41611: Regard vector types as primitiveKristof Umann2019-04-301-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugs.llvm.org/show_bug.cgi?id=41611 Similarly to D61106, the checker ran over an llvm_unreachable for vector types: struct VectorSizeLong { VectorSizeLong() {} __attribute__((__vector_size__(16))) long x; }; void __vector_size__LongTest() { VectorSizeLong v; } Since, according to my short research, "The vector_size attribute is only applicable to integral and float scalars, although arrays, pointers, and function return values are allowed in conjunction with this construct." [src: https://gcc.gnu.org/onlinedocs/gcc-4.6.1/gcc/Vector-Extensions.html#Vector-Extensions] vector types are safe to regard as primitive. Differential Revision: https://reviews.llvm.org/D61246 llvm-svn: 359539
* [analyzer] SmartPtrModeling: Fix a null dereference.Artem Dergachev2019-04-301-1/+1
| | | | | | | | | Don't crash when trying to model a call in which the callee is unknown in compile time, eg. a pointer-to-member call. Differential Revision: https://reviews.llvm.org/D61285 llvm-svn: 359530
* [Analyzer] Iterator Checkers - Do an early return after handling callsAdam Balogh2019-04-261-22/+64
| | | | | | | | | | | This patch is more of a fix than a real improvement: in checkPostCall() we should return immediately after finding the right call and handling it. This both saves unnecessary processing and double-handling calls by mistake. Differential Revision: https://reviews.llvm.org/D61134 llvm-svn: 359283
* [analyzer] RetainCount: Allow offsets in return values.Artem Dergachev2019-04-261-2/+4
| | | | | | | | | | | | | | | | | | Because RetainCountChecker has custom "local" reasoning about escapes, it has a separate facility to deal with tracked symbols at end of analysis and check them for leaks regardless of whether they're dead or not. This facility iterates over the list of tracked symbols and reports them as leaks, but it needs to treat the return value specially. Some custom allocators tend to return the value with an offset, storing extra metadata at the beginning of the buffer. In this case the return value would be a non-base region. In order to avoid false positives, we still need to find the original symbol within the return value, otherwise it'll be unable to match it to the item in the list of tracked symbols. Differential Revision: https://reviews.llvm.org/D60991 llvm-svn: 359263
* [analyzer] Add FIXMEs for alpha.unix.cstring.OutOfBounds false positives.Artem Dergachev2019-04-251-0/+4
| | | | | | | Caused by incorrect strlcat() modeling in r332303, cf. https://bugs.llvm.org/show_bug.cgi?id=37687#c8 llvm-svn: 359237
* [analyzer][UninitializedObjectChecker] PR41590: Regard _Atomic types as ↵Kristof Umann2019-04-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | primitive https://bugs.llvm.org/show_bug.cgi?id=41590 For the following code snippet, UninitializedObjectChecker crashed: struct MyAtomicInt { _Atomic(int) x; MyAtomicInt() {} }; void entry() { MyAtomicInt b; } The problem was that _Atomic types were not regular records, unions, dereferencable or primitive, making the checker hit the llvm_unreachable at lib/StaticAnalyzer/Checkers/UninitializedObject/UninitializedObjectChecker.cpp:347. The solution is to regard these types as primitive as well. The test case shows that with this addition, not only are we able to get rid of the crash, but we can identify x as uninitialized. Differential Revision: https://reviews.llvm.org/D61106 llvm-svn: 359230
* [Analyzer] Second fix for last commit for IteratorCheckerAdam Balogh2019-04-231-1/+1
| | | | | | | A variable was redeclared instead of assigned in an internal block, leaving the original uninitialized. This is fixed now. llvm-svn: 358971
* [Analyzer] Fix for previous commitAdam Balogh2019-04-231-2/+2
| | | | | | | | A compilation warning was in my previous commit which broke the buildbot because it is using `-Werror` for compilation. This patch fixes this issue. llvm-svn: 358955
* [Analyzer] Instead of recording comparisons in interator checkers do an ↵Adam Balogh2019-04-231-258/+126
| | | | | | | | | | | | | | | | | | eager state split Currently iterator checkers record comparison of iterator positions and process them for keeping track the distance between them (e.g. whether a position is the same as the end position). However this makes some processing unnecessarily complex and it is not needed at all: we only need to keep track between the abstract symbols stored in these iterator positions. This patch changes this and opens the path to comparisons to the begin() and end() symbols between the container (e.g. size, emptiness) which are stored as symbols, not iterator positions. The functionality of the checker is unchanged. Differential Revision: https://reviews.llvm.org/D53701 llvm-svn: 358951
* [analyzer] PR41269: Add a bit of C++ smart pointer modeling.Artem Dergachev2019-04-234-0/+117
| | | | | | | | | | | | | Implement cplusplus.SmartPtrModeling, a new checker that doesn't emit any warnings but models methods of smart pointers more precisely. For now the only thing it does is make `(bool) P` return false when `P` is a freshly moved pointer. This addresses a false positive in the use-after-move-checker. Differential Revision: https://reviews.llvm.org/D60796 llvm-svn: 358944
* [analyzer] Move UninitializedObjectChecker out of alphaKristof Umann2019-04-191-5/+5
| | | | | | | | | Moved UninitializedObjectChecker from the 'alpha.cplusplus' to the 'optin.cplusplus' package. Differential Revision: https://reviews.llvm.org/D58573 llvm-svn: 358797
* Reapply "[analyzer] Introduce a simplified API for adding custom path notes."Artem Dergachev2019-04-191-36/+11
| | | | | | | | This reapplies commit r357323, fixing memory leak found by LSan. Differential Revision: https://reviews.llvm.org/D58367 llvm-svn: 358781
OpenPOWER on IntegriCloud