summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Checkers
Commit message (Collapse)AuthorAgeFilesLines
* [CStringSyntaxChecker] Fix build bot builds != x86 archsDavid Carlier2018-07-201-8/+9
| | | | | | | | | | Reviewers: NoQ,george.karpenkov Reviewed By: NoQ Differential Revision: https://reviews.llvm.org/D49588 llvm-svn: 337611
* [analyzer] Rename DanglingInternalBufferChecker to InnerPointerChecker.Reka Kovacs2018-07-204-35/+34
| | | | | | Differential Revision: https://reviews.llvm.org/D49553 llvm-svn: 337559
* Change \t to spacesFangrui Song2018-07-202-2/+2
| | | | llvm-svn: 337530
* [CStringSyntaxChecker] Check strlcpy sizeof syntaxDavid Carlier2018-07-191-0/+62
| | | | | | | | | | | | | | | | | The last argument is expected to be the destination buffer size (or less). Detects if it points to destination buffer size directly or via a variable. Detects if it is an integral, try to detect if the destination buffer can receive the source length. Updating bsd-string.c unit tests as it make it fails now. Reviewers: george.karpenpov, NoQ Reviewed By: george.karpenkov Differential Revision: https://reviews.llvm.org/D48884 llvm-svn: 337499
* [analyzer] Fix memory sanitizer error in MallocChecker.Reka Kovacs2018-07-191-3/+3
| | | | | | | | StringRef's data() returns a string that may be non-null-terminated. Switch to using StringRefs from const char pointers in visitor notes to avoid problems. llvm-svn: 337474
* [analyzer] Fix disappearing notes in DanglingInternalBufferChecker testsReka Kovacs2018-07-191-2/+3
| | | | | | Correct a mistake of the exact same kind I am writing this checker for. llvm-svn: 337466
* [analyzer] Add support for more basic_string API inReka Kovacs2018-07-192-11/+71
| | | | | | | | | | | | | DanglingInternalBufferChecker. A pointer referring to the elements of a basic_string may be invalidated by calling a non-const member function, except operator[], at, front, back, begin, rbegin, end, and rend. The checker now warns if the pointer is used after such operations. Differential Revision: https://reviews.llvm.org/D49360 llvm-svn: 337463
* [analyzer] Make checkEndFunction() give access to the return statement.Reka Kovacs2018-07-169-17/+23
| | | | | | Differential Revision: https://reviews.llvm.org/D49387 llvm-svn: 337215
* [analyzer] Fix GCDAntipatternChecker to only fire when the semaphore is ↵George Karpenkov2018-07-161-1/+3
| | | | | | | | | | | | initialized to zero Initializing a semaphore with a different constant most likely signals a different intent rdar://41802552 Differential Revision: https://reviews.llvm.org/D48911 llvm-svn: 337212
* [Analyzer] Mark `SymbolData` parts of iterator position as live in program ↵Adam Balogh2018-07-161-21/+33
| | | | | | | | | | | | | | state maps Marking a symbolic expression as live is non-recursive. In our checkers we either use conjured symbols or conjured symbols plus/minus integers to represent abstract position of iterators, so in this latter case we also must mark the `SymbolData` part of these symbolic expressions as live to prevent them from getting reaped. Differential Revision: https://reviews.llvm.org/D48764 llvm-svn: 337151
* [Analyzer] alpha.unix.cstring.OutOfBounds checker enable/disable fixAdam Balogh2018-07-131-6/+6
| | | | | | | | | | | | | | | | | | It was not possible to disable alpha.unix.cstring.OutOfBounds checker's reports since unix.Malloc checker always implicitly enabled the filter. Moreover if the checker was disabled from command line (-analyzer-disable-checker ..) the out of bounds warnings were nevertheless emitted under different checker names such as unix.cstring.NullArg, or unix.Malloc. This patch fixes the case sot that Malloc checker only enables implicitly the underlying modeling of strcpy, memcpy etc. but not the warning messages that would have been emmitted by alpha.unix.cstring.OutOfBounds Patch by: Dániel Krupp Differential Revision: https://reviews.llvm.org/D48831 llvm-svn: 337000
* [analyzer][UninitializedObjectChecker] Fixed captured lambda variable nameKristof Umann2018-07-131-18/+21
| | | | | | Differential Revision: https://reviews.llvm.org/D48291 llvm-svn: 336995
* [analyzer][UninitializedObjectChecker] Support for MemberPointerTypesKristof Umann2018-07-131-29/+11
| | | | | | Differential Revision: https://reviews.llvm.org/D48325 llvm-svn: 336994
* [analyzer][UninitializedObjectChecker] Moved non-member functions out of the ↵Kristof Umann2018-07-121-17/+17
| | | | | | | | | | | anonymous namespace As the code for the checker grew, it became increasinly difficult to see whether a function was global or statically defined. In this patch, anything that isn't a type declaration or definition was moved out of the anonymous namespace and is marked as static. llvm-svn: 336901
* [analyzer] Track multiple raw pointer symbols in DanglingInternalBufferChecker.Reka Kovacs2018-07-111-18/+50
| | | | | | | | | | | | Previously, the checker only tracked one raw pointer symbol for each container object. But member functions returning a pointer to the object's inner buffer may be called on the object several times. These pointer symbols are now collected in a set inside the program state map and thus all of them is checked for use-after-free problems. Differential Revision: https://reviews.llvm.org/D49057 llvm-svn: 336835
* [analyzer] Partial revert of https://reviews.llvm.org/D49050George Karpenkov2018-07-111-8/+7
| | | | llvm-svn: 336755
* [analyzer] Pass through all arguments from the registerChecker() to the ↵George Karpenkov2018-07-111-7/+8
| | | | | | | | | | checker constructor A lot of checkers could be cleaned up in a similar way Differential Revision: https://reviews.llvm.org/D49050 llvm-svn: 336753
* [analyzer] Add support for data() in DanglingInternalBufferChecker.Reka Kovacs2018-07-071-5/+6
| | | | | | | | | DanglingInternalBufferChecker now tracks use-after-free problems related to the incorrect usage of std::basic_string::data(). Differential Revision: https://reviews.llvm.org/D48532 llvm-svn: 336497
* [analyzer] Highlight c_str() call in DanglingInternalBufferChecker.Reka Kovacs2018-07-073-10/+88
| | | | | | | | | | Add a bug visitor to DanglingInternalBufferChecker that places a note at the point where the dangling pointer was obtained. The visitor is handed over to MallocChecker and attached to the report there. Differential Revision: https://reviews.llvm.org/D48522 llvm-svn: 336495
* [analyzer] Fix -Wcovered-switch-default warning in MallocChecker.Reka Kovacs2018-07-071-1/+0
| | | | | | Remove unnecessary default case that caused buildbot failures. llvm-svn: 336493
* [analyzer] Highlight container object destruction in MallocChecker.Reka Kovacs2018-07-071-14/+46
| | | | | | | | | Extend MallocBugVisitor to place a note at the point where objects with AF_InternalBuffer allocation family are destroyed. Differential Revision: https://reviews.llvm.org/D48521 llvm-svn: 336489
* [analyzer][UninitializedObjectChecker] Added a NotesAsWarnings flagKristof Umann2018-06-291-21/+53
| | | | | | | | | | In order to better support consumers of the plist output that don't parse note entries just yet, a 'NotesAsWarnings' flag was added. If it's set to true, all notes will be converted to warnings. Differential Revision: https://reviews.llvm.org/D48285 llvm-svn: 335964
* [Analyzer] Iterator Checker - Part 2: Increment, decrement operators and ↵Adam Balogh2018-06-281-31/+448
| | | | | | | | | | | | | ahead-of-begin checks Add handling of the begin() funcion of containers to the iterator checkers, together with the pre- and postfix ++ and -- operators of the iterators. This makes possible the checking of iterators dereferenced ahead of the begin of the container. Differential Revision: https://reviews.llvm.org/D32642 llvm-svn: 335835
* [analyzer] [NFC] A convenient getter for getting a current stack frameGeorge Karpenkov2018-06-277-16/+14
| | | | | | Differential Revision: https://reviews.llvm.org/D44756 llvm-svn: 335701
* [analyzer] Do not run visitors until the fixpoint, run only once.George Karpenkov2018-06-2614-41/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In the current implementation, we run visitors until the fixed point is reached. That is, if a visitor adds another visitor, the currently processed path is destroyed, all diagnostics is discarded, and it is regenerated again, until it's no longer modified. This pattern has a few negative implications: - This loop does not even guarantee to terminate. E.g. just imagine two visitors bouncing a diagnostics around. - Performance-wise, e.g. for sqlite3 all visitors are being re-run at least 10 times for some bugs. We have already seen a few reports where it leads to timeouts. - If we want to add more computationally intense visitors, this will become worse. - From architectural standpoint, the current layout requires copying visitors, which is conceptually wrong, and can be annoying (e.g. no unique_ptr on visitors allowed). The proposed change is a much simpler architecture: the outer loop processes nodes upwards, and whenever the visitor is added it only processes current nodes and above, thus guaranteeing termination. Differential Revision: https://reviews.llvm.org/D47856 llvm-svn: 335666
* Add const qualifier on FieldChainInfoComparator::operator()Steven Wu2018-06-221-1/+1
| | | | | | | libcxx has user defined warning to check for non const call operator. Silence the warning by adding the const on operator(). llvm-svn: 335366
* [analyzer] Made a buildbot happy.Kristof Umann2018-06-191-7/+9
| | | | | | | Since `isPrimitiveType` was only used in an assert, a builbot with `-Werror` and no asserts enabled failed to build it as it was unused. llvm-svn: 335030
* [analyzer] Checker for uninitialized C++ objectsKristof Umann2018-06-182-0/+670
| | | | | | | | | | | | | | | | | | This checker analyzes C++ constructor calls, and reports uninitialized fields. Due to the nature of this problem (uninitialized fields after an object construction), this checker doesn't search for bugs, but rather is a tool to enforce a specific programming model where every field needs to be initialized. This checker lands in alpha for now, and a number of followup patches will be made to reduce false negatives and to make it easier for the user to understand what rules the checker relies on, eg. whether a derived class' constructor is responsible for initializing inherited data members or whether it should be handled in the base class' constructor. Differential Revision: https://reviews.llvm.org/D45532 llvm-svn: 334935
* [analyzer] Clean up the program state map of DanglingInternalBufferChecker.Reka Kovacs2018-06-091-1/+22
| | | | | | | | | | Symbols are cleaned up from the program state map when they go out of scope. Memory regions are cleaned up when the corresponding object is destroyed, and additionally in 'checkDeadSymbols' in case destructor modeling was incomplete. Differential Revision: https://reviews.llvm.org/D47416 llvm-svn: 334352
* [analyzer] Add dangling internal buffer check.Reka Kovacs2018-06-094-2/+139
| | | | | | | | | | | | This check will mark raw pointers to C++ standard library container internal buffers 'released' when the objects themselves are destroyed. Such information can be used by MallocChecker to warn about use-after-free problems. In this first version, 'std::basic_string's are supported. Differential Revision: https://reviews.llvm.org/D47135 llvm-svn: 334348
* [analyzer] Trust _Nonnull annotations, and trust analyzer knowledge about ↵George Karpenkov2018-05-311-5/+43
| | | | | | | | | | | | | | | receiver nullability Previously, the checker was using the nullability of the expression, which is nonnull IFF both receiver and method are annotated as _Nonnull. However, the receiver could be known to the analyzer to be nonnull without being explicitly marked as _Nonnull. rdar://40635584 Differential Revision: https://reviews.llvm.org/D47510 llvm-svn: 333612
* [analyzer] Remove the redundant check about same state transition in ↵Henry Wong2018-05-301-3/+1
| | | | | | | | | | | | | | | | `ArrayBoundCheckerV2.cpp`. Summary: Since the `addTransitionImpl()` has a check about same state transition, there is no need to check it in `ArrayBoundCheckerV2.cpp`. Reviewers: NoQ, xazax.hun, george.karpenkov Reviewed By: NoQ Subscribers: szepet, rnkovacs, a.sidorin, cfe-commits, MTC Differential Revision: https://reviews.llvm.org/D47451 llvm-svn: 333531
* [analyzer] Add security checks for bcmp(), bcopy(), bzero().Artem Dergachev2018-05-261-0/+141
| | | | | | | | | | | These functions are obsolete. The analyzer would advice to replace them with memcmp(), memcpy() or memmove(), or memset(). Patch by Tom Rix! Differential Revision: https://reviews.llvm.org/D41881 llvm-svn: 333326
* [analyzer] CStringChecker fix for strlcpy when no bytes are copied to the ↵David Carlier2018-05-231-1/+5
| | | | | | | | | | | | | | dest buffer Again, strlc* does not return a pointer so the zero size case doest not fit. Reviewers: NoQ, george.karpenkov Reviewed by: NoQ Differential Revision: https://reviews.llvm.org/D47007 llvm-svn: 333060
* [analyzer] Extend ObjCAutoreleaseWriteChecker to catch block declarations ↵George Karpenkov2018-05-161-7/+12
| | | | | | | | with autoreleasing variables Differential Revision: https://reviews.llvm.org/D46984 llvm-svn: 332546
* [analyzer] Change the warning message for GCD antipattern checkerGeorge Karpenkov2018-05-161-2/+2
| | | | llvm-svn: 332544
* [analyzer] Improve the modeling of memset().Henry Wong2018-05-161-3/+99
| | | | | | | | | | | | Since there is no perfect way bind the non-zero value with the default binding, this patch only considers the case where buffer's offset is zero and the char value is 0. And according to the value for overwriting, decide how to update the string length. Reviewers: dcoughlin, NoQ, xazax.hun, a.sidorin, george.karpenkov Reviewed By: NoQ Differential Revision: https://reviews.llvm.org/D44934 llvm-svn: 332463
* [analyzer] Re-apply r331096 "CStringChecker: Add support for BSD strlcpy()...".Artem Dergachev2018-05-141-54/+97
| | | | | | | | | | Fixed after revert in r331401. Patch by David Carlier! Differential Revision: https://reviews.llvm.org/D45177 llvm-svn: 332303
* [analyzer] Extend the ObjCAutoreleaseWriteChecker to warn on captures as wellGeorge Karpenkov2018-05-141-29/+51
| | | | | | | | | | A common pattern is that the code in the block does not write into the variable explicitly, but instead passes it to a helper function which performs the write. Differential Revision: https://reviews.llvm.org/D46772 llvm-svn: 332300
* [analyzer] Ignore the nullability quantifiers for autoreleasewritecheckerGeorge Karpenkov2018-05-111-2/+2
| | | | llvm-svn: 332136
* Remove \brief commands from doxygen comments.Adrian Prantl2018-05-0910-52/+52
| | | | | | | | | | | | | | | | | | | This is similar to the LLVM change https://reviews.llvm.org/D46290. We've been running doxygen with the autobrief option for a couple of years now. This makes the \brief markers into our comments redundant. Since they are a visual distraction and we don't want to encourage more \brief markers in new code either, this patch removes them all. Patch produced by for i in $(git grep -l '\@brief'); do perl -pi -e 's/\@brief //g' $i & done for i in $(git grep -l '\\brief'); do perl -pi -e 's/\\brief //g' $i & done Differential Revision: https://reviews.llvm.org/D46320 llvm-svn: 331834
* [analyzer] pr18953: Split C++ zero-initialization from default initialization.Artem Dergachev2018-05-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | The bindDefault() API of the ProgramState allows setting a default value for reads from memory regions that were not preceded by writes. It was used for implementing C++ zeroing constructors (i.e. default constructors that boil down to setting all fields of the object to 0). Because differences between zeroing consturctors and other forms of default initialization have been piling up (in particular, zeroing constructors can be called multiple times over the same object, probably even at the same offset, requiring a careful and potentially slow cleanup of previous bindings in the RegionStore), we split the API in two: bindDefaultInitial() for modeling initial values and bindDefaultZero() for modeling zeroing constructors. This fixes a few assertion failures from which the investigation originated. The imperfect protection from both inability of the RegionStore to support binding extents and lack of information in ASTRecordLayout has been loosened because it's, well, imperfect, and it is unclear if it fixing more than it was breaking. Differential Revision: https://reviews.llvm.org/D46368 llvm-svn: 331561
* [analyzer] Revert r331096 "CStringChecker: Add support for BSD strlcpy()...".Artem Dergachev2018-05-021-39/+2
| | | | | | | | | The return values of the newly supported functions were not handled correctly: strlcpy()/strlcat() return string sizes rather than pointers. Differential Revision: https://reviews.llvm.org/D45177 llvm-svn: 331401
* [analyzer] Add `TaintBugVisitor` to the ArrayBoundV2, DivideZero and VLASize.Henry Wong2018-05-023-25/+31
| | | | | | | | | | | | | | Summary: Add `TaintBugVisitor` to the ArrayBoundV2, DivideZero, VLASize to be able to indicate where the taint information originated from. Reviewers: NoQ, george.karpenkov, xazax.hun, a.sidorin Reviewed By: NoQ Subscribers: szepet, rnkovacs, cfe-commits, MTC Differential Revision: https://reviews.llvm.org/D46007 llvm-svn: 331345
* [analyzer] CStringChecker: Add support for BSD strlcpy() and strlcat().Artem Dergachev2018-04-271-2/+39
| | | | | | | | Patch by David Carlier! Differential Revision: https://reviews.llvm.org/D45177 llvm-svn: 331096
* [analyzer] ObjCAutoreleaseWrite: Support a few more APIs and fix warning text.Artem Dergachev2018-04-271-6/+31
| | | | | | API list and improved warning text composed by Devin Coughlin. llvm-svn: 331089
* [analyzer] Move `TaintBugVisitor` from `GenericTaintChecker.cpp` to ↵Henry Wong2018-04-231-39/+0
| | | | | | | | | | | | | | | | `BugReporterVisitors.h`. Summary: `TaintBugVisitor` is a universal visitor, and many checkers rely on it, such as `ArrayBoundCheckerV2.cpp`, `DivZeroChecker.cpp` and `VLASizeChecker.cpp`. Moving `TaintBugVisitor` to `BugReporterVisitors.h` enables other checker can also track where `tainted` value came from. Reviewers: NoQ, george.karpenkov, xazax.hun Reviewed By: george.karpenkov Subscribers: szepet, rnkovacs, a.sidorin, cfe-commits, MTC Differential Revision: https://reviews.llvm.org/D45682 llvm-svn: 330596
* [analyzer] CStringChecker.cpp - Code refactoring on bug report.Henry Wong2018-04-231-100/+96
| | | | | | | | | | Reviewers: NoQ, george.karpenkov, xazax.hun Reviewed By: george.karpenkov Differential Revision: https://reviews.llvm.org/D44557 llvm-svn: 330589
* [analyzer] RetainCount: Accept more "safe" CFRetain wrappers.Artem Dergachev2018-04-191-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | r315736 added support for the misplaced CF_RETURNS_RETAINED annotation on CFRetain() wrappers. It works by trusting the function's name (seeing if it confirms to the CoreFoundation naming convention) rather than the annotation. There are more false positives caused by users using a different naming convention, namely starting the function name with "retain" or "release" rather than suffixing it with "retain" or "release" respectively. Because this isn't according to the naming convention, these functions are usually inlined and the annotation is therefore ignored, which is correct. But sometimes we run out of inlining stack depth and the function is evaluated conservatively and then the annotation is trusted. Add support for the "alternative" naming convention and test the situation when we're running out of inlining stack depth. rdar://problem/18270122 Differential Revision: https://reviews.llvm.org/D45117 llvm-svn: 330375
* Clean carriage returns from lib/ and include/. NFC.Malcolm Parsons2018-04-161-330/+330
| | | | | | | | | | | | | | | | | | | | | | | | Summary: Clean carriage returns from lib/ and include/. NFC. (I have to make this change locally in order for `git diff` to show sane output after I edit a file, so I might as well ask for it to be committed. I don't have commit privs myself.) (Without this patch, `git rebase`ing any change involving SemaDeclCXX.cpp is a real nightmare. :( So while I have no right to ask for this to be committed, geez would it make my workflow easier if it were.) Here's the command I used to reformat things. (Requires bash and OSX/FreeBSD sed.) git grep -l $'\r' lib include | xargs sed -i -e $'s/\r//' find lib include -name '*-e' -delete Reviewers: malcolm.parsons Reviewed By: malcolm.parsons Subscribers: emaste, krytarowski, cfe-commits Differential Revision: https://reviews.llvm.org/D45591 Patch by Arthur O'Dwyer. llvm-svn: 330112
OpenPOWER on IntegriCloud