| Commit message (Collapse) | Author | Age | Files | Lines |
... | |
|
|
|
| |
llvm-svn: 133472
|
|
|
|
|
|
| |
functionality change.
llvm-svn: 133410
|
|
|
|
|
|
| |
the size argument. strncat is not yet up-to-date, but I'm leaving it enabled for now (there shouldn't be any false positives, at least...)
llvm-svn: 133408
|
|
|
|
|
|
| |
diagnostics, and make it easier to provide custom messages for overflow checking, in preparation for re-enabling strncpy checking.
llvm-svn: 133406
|
|
|
|
|
|
| |
literal has an embedded null character, and where both arguments are the same buffer. Also use nested ifs rather than early returns; in this case early returns will lose any assumptions we've made earlier in the function.
llvm-svn: 133154
|
|
|
|
|
|
|
|
| |
I will not commit without building first.
I will not commit without building first.
I will not commit without building first...
llvm-svn: 133150
|
|
|
|
|
|
| |
SValBuilder::getComparisonType() to just referencing IntTy.
llvm-svn: 133149
|
|
|
|
|
|
|
|
|
|
| |
Language-design credit goes to a lot of people, but I particularly want
to single out Blaine Garst and Patrick Beard for their contributions.
Compiler implementation credit goes to Argyrios, Doug, Fariborz, and myself,
in no particular order.
llvm-svn: 133103
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- (bounded copies) Be more conservative about how much is being copied.
- (str(n)cat) If we can't compute the exact final length of an append operation, we can still lower-bound it.
- (stpcpy) Fix the conjured return value at the end to actually be returned.
This requires these supporting changes:
- C string metadata symbols are still live even when buried in a SymExpr.
- "Hypothetical" C string lengths, to represent a value that /will/ be passed to setCStringLength() if all goes well. (The idea is to allow for temporary constrainable symbols that may end up becoming permanent.)
- The 'checkAdditionOverflow' helper makes sure that the two strings being appended in a strcat don't overflow size_t. This should never *actually* happen; the real effect is to keep the final string length from "wrapping around" in the constraint manager.
This doesn't actually test the "bounded" operations (strncpy and strncat) because they can leave strings unterminated. Next on the list!
llvm-svn: 133046
|
|
|
|
|
|
| |
binding. No tests yet because the only thing that sets string length is strcpy(), and that needs some work anyway.
llvm-svn: 133044
|
|
|
|
|
|
| |
C++. Its external name is now unix.experimental.CString.
llvm-svn: 132958
|
|
|
|
| |
llvm-svn: 132956
|
|
|
|
|
|
| |
can't properly model (yet?) to string-fail.c.
llvm-svn: 132955
|
|
|
|
| |
llvm-svn: 132618
|
|
|
|
|
|
| |
memcpy(). Also handle all memcpy-family return values in evalCopyCommon(), rather than having some outside and some inside.
llvm-svn: 132617
|
|
|
|
| |
llvm-svn: 132614
|
|
|
|
| |
llvm-svn: 132608
|
|
|
|
| |
llvm-svn: 132607
|
|
|
|
| |
llvm-svn: 132605
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- New isDefined() function checks for deletedness
- isThisDeclarationADefinition checks for deletedness
- New doesThisDeclarationHaveABody() does what
isThisDeclarationADefinition() used to do
- The IsDeleted bit is not propagated across redeclarations
- isDeleted() now checks the canoncial declaration
- New isDeletedAsWritten() does what it says on the tin.
- isUserProvided() now correct (thanks Richard!)
This fixes the bug that we weren't catching
void foo() = delete;
void foo() {}
as being a redefinition.
llvm-svn: 131013
|
|
|
|
|
|
| |
changes need to be made to properly support modeling of it since it potentially leaves strings non-null terminated.
llvm-svn: 130758
|
|
|
|
|
|
| |
arguments to C++ constructors. This is a stop-gap measure for Objective-C++ code that uses smart pointers to manage reference counts.
llvm-svn: 130711
|
|
|
|
|
|
| |
creating substrings if necessary and calling the appropriate StringRef::compare/compare_lower().
llvm-svn: 130708
|
|
|
|
| |
llvm-svn: 130598
|
|
|
|
|
|
| |
bounded version of StringRef::compare() because bounded version of StringRef::compare() is going to be removed.
llvm-svn: 130425
|
|
|
|
|
|
|
|
| |
a cast was successful. If the value of an argument was unknown, the cast would result in a NULL pointer which was later being dereferenced.
This fixes Bugzilla #9806.
llvm-svn: 130422
|
|
|
|
| |
llvm-svn: 130398
|
|
|
|
|
|
|
|
| |
a size of 0 is equivalent to free(). The memory region should be marked as free and not used again.
Unit tests f2_realloc_0(), f6_realloc(), and f7_realloc() contributed by Marshall Clow <mclow.lists@gmail.com>. Thanks!
llvm-svn: 130303
|
|
|
|
|
|
|
|
| |
direct lookup to values bound to expressions, without
resulting to lazy logic. This is critical for the OSAtomicChecker that does a simulated load on any arbitrary expression.
llvm-svn: 130292
|
|
|
|
|
|
| |
bounds. Requires LLVM svn r129582.
llvm-svn: 130161
|
|
|
|
| |
llvm-svn: 130068
|
|
|
|
|
|
| |
pointers. Fixes PR9746.
llvm-svn: 129741
|
|
|
|
| |
llvm-svn: 129567
|
|
|
|
|
|
| |
Luis Felipe Strano Moraes!
llvm-svn: 129559
|
|
|
|
|
|
| |
declared in protocols.
llvm-svn: 129395
|
|
|
|
|
|
|
|
| |
active block on the worklist
impacts the results of the check.
llvm-svn: 129394
|
|
|
|
|
|
| |
0-index of a symbolic region. In many cases that isn't really the base offset.
llvm-svn: 129366
|
|
|
|
|
|
| |
inputs are not NULL and are real C strings, then does the comparison and binds the proper return value. Unit tests included.
llvm-svn: 129364
|
|
|
|
|
|
| |
Validates inputs are not NULL, checks for overlapping strings, concatenates the strings checking for buffer overflow, sets the length of the destination string to the sum of the s1 length and the s2 length, binds the return value to the s1 value.
llvm-svn: 129215
|
|
|
|
|
|
|
|
| |
generate a warning any time the strcat() function is used with a note suggesting to use a function which provides bounded buffers. CWE-119.
Also, brings the security syntax checker more inline with coding standards.
llvm-svn: 128916
|
|
|
|
|
|
| |
doesn't get called for each CallExpr. Instead it does a switch and only runs the check for the proper identifier. Slight speed improvement (probably significant on very large ASTs), and should make it easier and more clear to add more checks for other CallExpr's later.
llvm-svn: 128785
|
|
|
|
| |
llvm-svn: 128762
|
|
|
|
|
|
| |
didn't know how to handle a specific Expr type.
llvm-svn: 128761
|
|
|
|
|
|
| |
a given CFGBlock was analyzed too many times.
llvm-svn: 128760
|
|
|
|
|
|
| |
generate a warning any time the strcpy() function is used with a note suggesting to use a function which provides bounded buffers.
llvm-svn: 128679
|
|
|
|
|
|
| |
Models mempcpy() so that if length is NULL the destination pointer is returned. Otherwise, the source and destination are confirmed not to be NULL and not overlapping. Finally the copy is validated to not cause a buffer overrun and the return value is bound to the address of the byte after the last byte copied.
llvm-svn: 128677
|
|
|
|
| |
llvm-svn: 128670
|
|
|
|
| |
llvm-svn: 128512
|
|
|
|
|
|
| |
packages, and which packages/checkers are hidden.
llvm-svn: 128511
|
|
|
|
|
|
| |
commit r128474.
llvm-svn: 128475
|