summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Checkers
Commit message (Collapse)AuthorAgeFilesLines
...
* Add a basic CallGraph to Analysis.Anna Zaks2012-03-082-0/+49
| | | | | | | | | | The final graph contains a single root node, which is a parent of all externally available functions(and 'main'). As well as a list of Parentless/Unreachable functions, which are either truly unreachable or are unreachable due to our analyses imprecision. The analyzer checkers debug.DumpCallGraph or debug.ViewGraph can be used to look at the produced graph. Currently, the graph is not very precise, for example, it entirely skips edges resulted from ObjC method calls. llvm-svn: 152272
* Add static analyzer support for new NSArray/NSDictionary/NSNumber literals.Ted Kremenek2012-03-061-31/+89
| | | | llvm-svn: 152139
* [analyzer] Remove now-unused constant. No functionality change.Jordy Rose2012-03-061-2/+0
| | | | llvm-svn: 152080
* [analyzer] Fix unnecessary dyn_cast_or_null. No functionality change.Jordy Rose2012-03-061-2/+2
| | | | llvm-svn: 152078
* Teak CallAndMessageChecker to only warn about uninitialized struct fields in ↵Ted Kremenek2012-03-051-2/+18
| | | | | | | | | | call arguments when the called function is never inlined. Fixes <rdar://problem/10977037>. llvm-svn: 152073
* [analyzer] False positive in SelfInit - teach the checker about methodAnna Zaks2012-03-051-10/+35
| | | | | | calls with self as a parameter. llvm-svn: 152039
* [analyzer] Malloc should assume that ownership is transfered whenAnna Zaks2012-03-051-1/+10
| | | | | | calling an ObjC method ending with 'NoCopy'. llvm-svn: 152037
* [analyzer] do not warn about returning stack-allocated memory when it comes ↵Ted Kremenek2012-03-031-10/+18
| | | | | | from an ancestor stack frame. llvm-svn: 151964
* [analyzer] Fix a regression introduced in malloc withAnna Zaks2012-03-011-3/+7
| | | | | | | | | | attributes, introduced in r151188. + the test to catch it. Thanks to Ahmed Charles for pointing this out. llvm-svn: 151840
* Move llvm/ADT/SaveAndRestore.h -> llvm/Support/SaveAndRestore.h.Argyrios Kyrtzidis2012-03-011-1/+1
| | | | | | Needs llvm update. llvm-svn: 151829
* [analyzer] Malloc: A pointer might escape through CFContainers APIs,Anna Zaks2012-02-291-3/+38
| | | | | | | | | | | | funopen, setvbuf. Teach the checker and the engine about these APIs to resolve malloc false positives. As I am adding more of these APIs, it is clear that all this should be factored out into a separate callback (for example, region escapes). Malloc, KeyChainAPI and RetainRelease checkers could all use it. llvm-svn: 151737
* [analyzer] Tweak the UnreachableCode checker to not warning about ↵Ted Kremenek2012-02-291-0/+8
| | | | | | unreachable default blocks. Patch by Cyril Roelandt! llvm-svn: 151709
* [analyzer] Leaks should be uniqued by the allocation point in theAnna Zaks2012-02-281-4/+16
| | | | | | closest function context (RetainCountChecker). llvm-svn: 151661
* [analyzer] Retain release: drop the line number info from the leakAnna Zaks2012-02-281-3/+2
| | | | | | message. llvm-svn: 151657
* [analyzer] Leaks should be uniqued by the allocation point in theAnna Zaks2012-02-281-5/+12
| | | | | | closest function context (Keychain API). llvm-svn: 151613
* [analyzer] Fix Malloc False Positive (PR 12100)Anna Zaks2012-02-281-5/+23
| | | | | | | | When allocated buffer is passed to CF/NS..NoCopy functions, the ownership is transfered unless the deallocator argument is set to 'kCFAllocatorNull'. llvm-svn: 151608
* [analyzer] Leaks should be uniqued by the allocation point in theAnna Zaks2012-02-271-6/+13
| | | | | | | | | closest function context. This prevents us from uniqueing all leaks from the same allocation helper. radar://10932226 llvm-svn: 151592
* Move "clang/Analysis/Support/SaveAndRestore.h" to "llvm/ADT/SaveAndRestore.h"Argyrios Kyrtzidis2012-02-271-1/+1
| | | | | | | | to make it more widely available. Depends on llvm commit r151564 llvm-svn: 151566
* RetainCountChecker: don't adjust the retain count when analyzing a ↵Ted Kremenek2012-02-251-0/+15
| | | | | | ReturnStmt unless we are in the top-level call frame. We can do more later, but this makes the checker self-consistent (and fixes a crash). llvm-svn: 151426
* [analyzer] Malloc: reason about the ObjC messages and C++.Anna Zaks2012-02-241-20/+56
| | | | | | | | | | | Assume none of the ObjC messages defined in system headers free memory, except for the ones containing 'freeWhenDone' selector. Currently, just assume that the region escapes to the messages with 'freeWhenDone' (ideally, we want to treat it as 'free()'). For now, always assume that regions escape when passed to C++ methods. llvm-svn: 151410
* [analyzer] KeyChainAPI: unique the leaks by allocation site.Anna Zaks2012-02-231-21/+60
| | | | | | (Very similar to the previous change in malloc.) llvm-svn: 151297
* [analyzer] Malloc: unique leak reports by allocation site.Anna Zaks2012-02-231-3/+37
| | | | | | | | | When we find two leak reports with the same allocation site, report only one of them. Provide a helper method to BugReporter to facilitate this. llvm-svn: 151287
* [analyzer] Invalidate the region passed to pthread_setspecific() call.Anna Zaks2012-02-231-2/+12
| | | | | | | | | | | | | | | | | | Make this call an exception in ExprEngine::invalidateArguments: 'int pthread_setspecific(ptheread_key k, const void *)' stores a value into thread local storage. The value can later be retrieved with 'void *ptheread_getspecific(pthread_key)'. So even thought the parameter is 'const void *', the region escapes through the call. (Here we just blacklist the call in the ExprEngine's default logic. Another option would be to add a checker which evaluates the call and triggers the call to invalidate regions.) Teach the Malloc Checker, which treats all system calls as safe about the API. llvm-svn: 151220
* [analyzer] Malloc cleanup:Anna Zaks2012-02-221-99/+82
| | | | | | | | | | | | - We should not evaluate strdup in the Malloc Checker, it's the job of CString checker, so just update the RefState to reflect allocated memory. - Refactor to reduce LOC: remove some wrapper auxiliary functions, make all functions return the state and add the transition in one place (instead of in each auxiliary function). llvm-svn: 151188
* [analyzer] Malloc checker: mark 'strdup' and 'strndup' as allocators.Anna Zaks2012-02-221-20/+42
| | | | llvm-svn: 151124
* [analyzer] Malloc: fix another false positive.Anna Zaks2012-02-221-1/+11
| | | | | | | , when we return a symbol reachable to the malloced one via pointer arithmetic. llvm-svn: 151121
* [analyzer] Change naming in bug reports "tainted" -> "untrusted"Anna Zaks2012-02-221-4/+5
| | | | llvm-svn: 151120
* [analyzer] Make KeyChainAPI checker inlining-aware.Anna Zaks2012-02-211-1/+11
| | | | llvm-svn: 151007
* [analyzer] Make Malloc aware of inter-procedural execution + basicAnna Zaks2012-02-201-2/+7
| | | | | | tests. llvm-svn: 150993
* [analyzer] Turn on by default the Malloc Checker and a couple of CStringAnna Zaks2012-02-201-9/+13
| | | | | | | | | | | | checks: - unix.Malloc - Checks for memory leaks, double free, use-after-free. - unix.cstring.NullArg - Checks for null pointers passed as arguments to CString functions + evaluates CString functions. - unix.cstring.BadSizeArg - Checks for common anti-patterns in strncat size argument. llvm-svn: 150988
* Teach analyzer about NSAutoreleasePool -allocWithZone:. Fixes ↵Ted Kremenek2012-02-181-3/+5
| | | | | | <rdar://problem/10640253>. llvm-svn: 150892
* Adopt ExprEngine and checkers to ObjC property refactoring. Everything was ↵Ted Kremenek2012-02-182-8/+19
| | | | | | working, but now diagnostics are aware of message expressions implied by uses of properties. Fixes <rdar://problem/9241180>. llvm-svn: 150888
* Have conjured symbols depend on LocationContext, to add context sensitivity ↵Ted Kremenek2012-02-173-10/+12
| | | | | | for functions called more than once. llvm-svn: 150849
* [analyzer] Fix another false positive in the Malloc Checker, by makingAnna Zaks2012-02-173-0/+29
| | | | | | | | | | | | it aware of CString APIs that return the input parameter. Malloc Checker needs to know how the 'strcpy' function is evaluated. Introduce the dependency on CStringChecker for that. CStringChecker knows all about these APIs. Addresses radar://10864450 llvm-svn: 150846
* [analyzer] Generalize function name checking in CString checker.Anna Zaks2012-02-171-23/+39
| | | | | | | (Ex: It was not treating __inline_strcpy as strcpy. Will add tests that rely on this later on.) llvm-svn: 150845
* [analyzer] Malloc Checker: Clean up bug naming:Anna Zaks2012-02-161-15/+13
| | | | | | | - Rename the category "Logic Error" -> "Memory Error". - Shorten all the messages. llvm-svn: 150733
* [analyzer] Malloc Checker: Make the diagnostic visitor handle the caseAnna Zaks2012-02-161-22/+74
| | | | | | of failing realloc. + Minor cleanups. llvm-svn: 150732
* [analyzer] Malloc Checker: Give up when a pointer escapes into a struct.Anna Zaks2012-02-161-0/+6
| | | | | | | | We are not properly handling the memory regions that escape into struct fields, which led to a bunch of false positives. Be conservative here and give up when a pointer escapes into a struct. llvm-svn: 150658
* [analyzer] Malloc checker: make a bit safer.Anna Zaks2012-02-151-2/+6
| | | | llvm-svn: 150556
* [analyzer] Malloc Checker: add support for reallocf, which always freesAnna Zaks2012-02-151-22/+44
| | | | | | the passed in pointer on failure. llvm-svn: 150533
* [analyzer] Malloc Checker: add support for valloc + minor codeAnna Zaks2012-02-151-12/+19
| | | | | | hardening. llvm-svn: 150532
* [analyzer] Make Malloc Checker optimistic in presence of inlining.Anna Zaks2012-02-144-59/+124
| | | | | | | | | | | | (In response of Ted's review of r150112.) This moves the logic which checked if a symbol escapes through a parameter to invalidateRegionCallback (instead of post CallExpr visit.) To accommodate the change, added a CallOrObjCMessage parameter to checkRegionChanges callback. llvm-svn: 150513
* [analyzer] Malloc Checker: realloc: add dependency between the symbolsAnna Zaks2012-02-141-9/+6
| | | | | | | | | | | | | in realloc map. If there is no dependency, the reallocated ptr will get garbage collected before we know that realloc failed, which would lead us to missing a memory leak warning. Also added new test cases, which we can handle now. Plus minor cleanups. llvm-svn: 150446
* [analyzer] Malloc Checker: realloc: correct the way we are handing theAnna Zaks2012-02-131-8/+9
| | | | | | case when size is 0. llvm-svn: 150412
* [analyzer] Malloc checker: rework realloc handling:Anna Zaks2012-02-131-34/+80
| | | | | | | | | | | | | | | | | | | 1) Support the case when realloc fails to reduce False Positives. (We essentially need to restore the state of the pointer being reallocated.) 2) Realloc behaves differently under special conditions (from pointer is null, size is 0). When detecting these cases, we should consider under-constrained states (size might or might not be 0). The old version handled this in a very hacky way. The code did not differentiate between definite and possible (no consideration for under-constrained states). Further, after processing each special case, the realloc processing function did not return but chained to the next special case processing. So you could end up in an execution in which you first see the states in which size is 0 and realloc ~ free(), followed by the states corresponding to size is not 0 followed by the evaluation of the regular realloc behavior. llvm-svn: 150402
* [analyzer] Malloc Checker: reduce false negatives rate by assuming thatAnna Zaks2012-02-111-6/+28
| | | | | | | a pointer cannot escape through calls to system functions. Also, stop after reporting the first use-after-free. llvm-svn: 150315
* [analyzer] Malloc Checker: Report a leak when we are returning freedAnna Zaks2012-02-111-0/+6
| | | | | | | | | memory. (As per one test case, the existing checker thought that this could cause a lot of false positives - not sure if that's valid, to be verified.) llvm-svn: 150313
* [analyzer] Malloc checker: Leak bugs should be suppressed by sinks.Anna Zaks2012-02-111-18/+28
| | | | | | | Resolves a common false positive, where we were reporting a leak inside asserts llvm-svn: 150312
* [analyzer] MallocChecker: refactor/improve the symbol escape logic.Anna Zaks2012-02-111-71/+103
| | | | | | We use the same logic here as the RetainRelease checker. llvm-svn: 150311
* [analyzer] New checker for assignment of non-0/1 values to Boolean variables.Ryan Govostes2012-02-113-0/+162
| | | | llvm-svn: 150306
OpenPOWER on IntegriCloud