summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Checkers
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer] Add security checks for bcmp(), bcopy(), bzero().Artem Dergachev2018-05-261-0/+141
| | | | | | | | | | | These functions are obsolete. The analyzer would advice to replace them with memcmp(), memcpy() or memmove(), or memset(). Patch by Tom Rix! Differential Revision: https://reviews.llvm.org/D41881 llvm-svn: 333326
* [analyzer] CStringChecker fix for strlcpy when no bytes are copied to the ↵David Carlier2018-05-231-1/+5
| | | | | | | | | | | | | | dest buffer Again, strlc* does not return a pointer so the zero size case doest not fit. Reviewers: NoQ, george.karpenkov Reviewed by: NoQ Differential Revision: https://reviews.llvm.org/D47007 llvm-svn: 333060
* [analyzer] Extend ObjCAutoreleaseWriteChecker to catch block declarations ↵George Karpenkov2018-05-161-7/+12
| | | | | | | | with autoreleasing variables Differential Revision: https://reviews.llvm.org/D46984 llvm-svn: 332546
* [analyzer] Change the warning message for GCD antipattern checkerGeorge Karpenkov2018-05-161-2/+2
| | | | llvm-svn: 332544
* [analyzer] Improve the modeling of memset().Henry Wong2018-05-161-3/+99
| | | | | | | | | | | | Since there is no perfect way bind the non-zero value with the default binding, this patch only considers the case where buffer's offset is zero and the char value is 0. And according to the value for overwriting, decide how to update the string length. Reviewers: dcoughlin, NoQ, xazax.hun, a.sidorin, george.karpenkov Reviewed By: NoQ Differential Revision: https://reviews.llvm.org/D44934 llvm-svn: 332463
* [analyzer] Re-apply r331096 "CStringChecker: Add support for BSD strlcpy()...".Artem Dergachev2018-05-141-54/+97
| | | | | | | | | | Fixed after revert in r331401. Patch by David Carlier! Differential Revision: https://reviews.llvm.org/D45177 llvm-svn: 332303
* [analyzer] Extend the ObjCAutoreleaseWriteChecker to warn on captures as wellGeorge Karpenkov2018-05-141-29/+51
| | | | | | | | | | A common pattern is that the code in the block does not write into the variable explicitly, but instead passes it to a helper function which performs the write. Differential Revision: https://reviews.llvm.org/D46772 llvm-svn: 332300
* [analyzer] Ignore the nullability quantifiers for autoreleasewritecheckerGeorge Karpenkov2018-05-111-2/+2
| | | | llvm-svn: 332136
* Remove \brief commands from doxygen comments.Adrian Prantl2018-05-0910-52/+52
| | | | | | | | | | | | | | | | | | | This is similar to the LLVM change https://reviews.llvm.org/D46290. We've been running doxygen with the autobrief option for a couple of years now. This makes the \brief markers into our comments redundant. Since they are a visual distraction and we don't want to encourage more \brief markers in new code either, this patch removes them all. Patch produced by for i in $(git grep -l '\@brief'); do perl -pi -e 's/\@brief //g' $i & done for i in $(git grep -l '\\brief'); do perl -pi -e 's/\\brief //g' $i & done Differential Revision: https://reviews.llvm.org/D46320 llvm-svn: 331834
* [analyzer] pr18953: Split C++ zero-initialization from default initialization.Artem Dergachev2018-05-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | The bindDefault() API of the ProgramState allows setting a default value for reads from memory regions that were not preceded by writes. It was used for implementing C++ zeroing constructors (i.e. default constructors that boil down to setting all fields of the object to 0). Because differences between zeroing consturctors and other forms of default initialization have been piling up (in particular, zeroing constructors can be called multiple times over the same object, probably even at the same offset, requiring a careful and potentially slow cleanup of previous bindings in the RegionStore), we split the API in two: bindDefaultInitial() for modeling initial values and bindDefaultZero() for modeling zeroing constructors. This fixes a few assertion failures from which the investigation originated. The imperfect protection from both inability of the RegionStore to support binding extents and lack of information in ASTRecordLayout has been loosened because it's, well, imperfect, and it is unclear if it fixing more than it was breaking. Differential Revision: https://reviews.llvm.org/D46368 llvm-svn: 331561
* [analyzer] Revert r331096 "CStringChecker: Add support for BSD strlcpy()...".Artem Dergachev2018-05-021-39/+2
| | | | | | | | | The return values of the newly supported functions were not handled correctly: strlcpy()/strlcat() return string sizes rather than pointers. Differential Revision: https://reviews.llvm.org/D45177 llvm-svn: 331401
* [analyzer] Add `TaintBugVisitor` to the ArrayBoundV2, DivideZero and VLASize.Henry Wong2018-05-023-25/+31
| | | | | | | | | | | | | | Summary: Add `TaintBugVisitor` to the ArrayBoundV2, DivideZero, VLASize to be able to indicate where the taint information originated from. Reviewers: NoQ, george.karpenkov, xazax.hun, a.sidorin Reviewed By: NoQ Subscribers: szepet, rnkovacs, cfe-commits, MTC Differential Revision: https://reviews.llvm.org/D46007 llvm-svn: 331345
* [analyzer] CStringChecker: Add support for BSD strlcpy() and strlcat().Artem Dergachev2018-04-271-2/+39
| | | | | | | | Patch by David Carlier! Differential Revision: https://reviews.llvm.org/D45177 llvm-svn: 331096
* [analyzer] ObjCAutoreleaseWrite: Support a few more APIs and fix warning text.Artem Dergachev2018-04-271-6/+31
| | | | | | API list and improved warning text composed by Devin Coughlin. llvm-svn: 331089
* [analyzer] Move `TaintBugVisitor` from `GenericTaintChecker.cpp` to ↵Henry Wong2018-04-231-39/+0
| | | | | | | | | | | | | | | | `BugReporterVisitors.h`. Summary: `TaintBugVisitor` is a universal visitor, and many checkers rely on it, such as `ArrayBoundCheckerV2.cpp`, `DivZeroChecker.cpp` and `VLASizeChecker.cpp`. Moving `TaintBugVisitor` to `BugReporterVisitors.h` enables other checker can also track where `tainted` value came from. Reviewers: NoQ, george.karpenkov, xazax.hun Reviewed By: george.karpenkov Subscribers: szepet, rnkovacs, a.sidorin, cfe-commits, MTC Differential Revision: https://reviews.llvm.org/D45682 llvm-svn: 330596
* [analyzer] CStringChecker.cpp - Code refactoring on bug report.Henry Wong2018-04-231-100/+96
| | | | | | | | | | Reviewers: NoQ, george.karpenkov, xazax.hun Reviewed By: george.karpenkov Differential Revision: https://reviews.llvm.org/D44557 llvm-svn: 330589
* [analyzer] RetainCount: Accept more "safe" CFRetain wrappers.Artem Dergachev2018-04-191-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | r315736 added support for the misplaced CF_RETURNS_RETAINED annotation on CFRetain() wrappers. It works by trusting the function's name (seeing if it confirms to the CoreFoundation naming convention) rather than the annotation. There are more false positives caused by users using a different naming convention, namely starting the function name with "retain" or "release" rather than suffixing it with "retain" or "release" respectively. Because this isn't according to the naming convention, these functions are usually inlined and the annotation is therefore ignored, which is correct. But sometimes we run out of inlining stack depth and the function is evaluated conservatively and then the annotation is trusted. Add support for the "alternative" naming convention and test the situation when we're running out of inlining stack depth. rdar://problem/18270122 Differential Revision: https://reviews.llvm.org/D45117 llvm-svn: 330375
* Clean carriage returns from lib/ and include/. NFC.Malcolm Parsons2018-04-161-330/+330
| | | | | | | | | | | | | | | | | | | | | | | | Summary: Clean carriage returns from lib/ and include/. NFC. (I have to make this change locally in order for `git diff` to show sane output after I edit a file, so I might as well ask for it to be committed. I don't have commit privs myself.) (Without this patch, `git rebase`ing any change involving SemaDeclCXX.cpp is a real nightmare. :( So while I have no right to ask for this to be committed, geez would it make my workflow easier if it were.) Here's the command I used to reformat things. (Requires bash and OSX/FreeBSD sed.) git grep -l $'\r' lib include | xargs sed -i -e $'s/\r//' find lib include -name '*-e' -delete Reviewers: malcolm.parsons Reviewed By: malcolm.parsons Subscribers: emaste, krytarowski, cfe-commits Differential Revision: https://reviews.llvm.org/D45591 Patch by Arthur O'Dwyer. llvm-svn: 330112
* Fix typos in clangAlexander Kornienko2018-04-067-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Found via codespell -q 3 -I ../clang-whitelist.txt Where whitelist consists of: archtype cas classs checkk compres definit frome iff inteval ith lod methode nd optin ot pres statics te thru Patch by luzpaz! (This is a subset of D44188 that applies cleanly with a few files that have dubious fixes reverted.) Differential revision: https://reviews.llvm.org/D44188 llvm-svn: 329399
* [Attr] [NFC] Revert accidental change from r327405Joel E. Denny2018-04-021-1/+1
| | | | llvm-svn: 329005
* [analyzer] Fix assertion crash in CStringCheckerGeorge Karpenkov2018-03-311-5/+8
| | | | | | | | | | An offset might be unknown. rdar://39054939 Differential Revision: https://reviews.llvm.org/D45115 llvm-svn: 328912
* [analyzer] Remove the unused method declaration in `ValistChecker.cpp`.Henry Wong2018-03-301-1/+0
| | | | | | | | | | | | | | Summary: `getVariableNameFromRegion()` seems useless. Reviewers: xazax.hun, george.karpenkov Reviewed By: xazax.hun Subscribers: szepet, rnkovacs, a.sidorin, cfe-commits, MTC Differential Revision: https://reviews.llvm.org/D45081 llvm-svn: 328860
* [analyzer] Path-insensitive checker for writes into an auto-releasing pointerGeorge Karpenkov2018-03-292-0/+158
| | | | | | | | | | from the wrong auto-releasing pool, as such writes may crash. rdar://25301111 Differential Revision: https://reviews.llvm.org/D44722 llvm-svn: 328827
* [clang] Change std::sort to llvm::sort in response to r327219Mandeep Singh Grang2018-03-271-1/+1
| | | | | | | | | | | r327219 added wrappers to std::sort which randomly shuffle the container before sorting. This will help in uncovering non-determinism caused due to undefined sorting order of objects having the same key. To make use of that infrastructure we need to invoke llvm::sort instead of std::sort. llvm-svn: 328636
* [analyzer] Trust _Nonnull annotations for system frameworkGeorge Karpenkov2018-03-233-29/+57
| | | | | | | | | | | Changes the analyzer to believe that methods annotated with _Nonnull from system frameworks indeed return non null objects. Local methods with such annotation are still distrusted. rdar://24291919 Differential Revision: https://reviews.llvm.org/D44341 llvm-svn: 328282
* [analyzer] Extend GCDAntipatternChecker to match group_enter/group_leave patternGeorge Karpenkov2018-03-231-43/+104
| | | | | | | | rdar://38480416 Differential Revision: https://reviews.llvm.org/D44653 llvm-svn: 328281
* Revert r326782 "[analyzer] CStringChecker.cpp: Remove the duplicated check...".Artem Dergachev2018-03-211-0/+21
| | | | | | | It seems that the refactoring was causing a functional change and some warnings have disappeared. llvm-svn: 328067
* [analyzer] Suppress more MallocChecker positives in smart pointer destructors.Artem Dergachev2018-03-211-14/+39
| | | | | | | | | | | | | | | | | r326249 wasn't quite enough because we often run out of inlining stack depth limit and for that reason fail to see the atomics we're looking for. Add a more straightforward false positive suppression that is based on the name of the class. I.e. if we're releasing a pointer in a destructor of a "something shared/intrusive/reference/counting something ptr/pointer something", then any use-after-free or double-free that occurs later would likely be a false positive. rdar://problem/38013606 Differential Revision: https://reviews.llvm.org/D44281 llvm-svn: 328066
* [analyzer] Fix the crash in IteratorChecker.cpp when 'SymbolConjured' has a ↵Henry Wong2018-03-201-1/+1
| | | | | | | | | | null Stmt. When the loop has a null terminator statement and sets 'widen-loops=true', 'invalidateRegions' will constructs the 'SymbolConjured' with null 'Stmt'. And this will lead to a crash in 'IteratorChecker.cpp'. This patch use 'dyn_cast_or_null<>' instead of 'dyn_cast<>' in IteratorChecker.cpp. Differential Revision: https://reviews.llvm.org/D44606 llvm-svn: 327962
* Resolve unused variable 'VR' warning in RetainCountChecker.cppBjorn Pettersson2018-03-181-1/+1
| | | | | | | | | Getting rid of error: unused variable 'VR' [-Werror,-Wunused-variable] warning/error at lib/StaticAnalyzer/Checkers/RetainCountChecker.cpp:1933 llvm-svn: 327802
* [analyzer] Fix crashes in RetainCountChecker when underlying region is not a varGeorge Karpenkov2018-03-161-8/+12
| | | | | | | | | | | | For other regions, the error message contains a good indication of the problem, and there, in general, nothing helpful we can print. Error pointer to the problematic expression seems enough. rdar://37323555 Differential Revision: https://reviews.llvm.org/D44409 llvm-svn: 327727
* [analyzer] Fix the matcher for GCDAntipattern to look for "signal" call in ↵George Karpenkov2018-03-131-2/+2
| | | | | | | | all parameters rdar://38405904 llvm-svn: 327426
* Reland "[Attr] Fix parameter indexing for several attributes"Joel E. Denny2018-03-132-8/+10
| | | | | | | | | Relands r326602 (reverted in r326862) with new test and fix for PR36620. Differential Revision: https://reviews.llvm.org/D43248 llvm-svn: 327405
* [analyzer] Move the GCDAsyncSemaphoreChecker to optin.performanceGeorge Karpenkov2018-03-122-19/+26
| | | | | | | | rdar://38383753 Differential Revision: https://reviews.llvm.org/D44228 llvm-svn: 327309
* [analyzer] MmapWriteExecChecker: Add support for mprotect().Artem Dergachev2018-03-091-3/+4
| | | | | | | | | | | mprotect() allows setting memory access flags similarly to mmap(), causing similar security issues if these flags are needlessly broad. Patch by David Carlier! Differential Revision: https://reviews.llvm.org/D44250 llvm-svn: 327098
* [analyzer] [PointerArithChecker] do not warn on indexes into vector typesGeorge Karpenkov2018-03-071-0/+4
| | | | | | | | rdar://35041502 Differential Revision: https://reviews.llvm.org/D44172 llvm-svn: 326952
* [analyzer] [NFC] Minor refactoring of NonNullParamCheckerGeorge Karpenkov2018-03-071-68/+65
| | | | | | Differential Revision: https://reviews.llvm.org/D43917 llvm-svn: 326935
* [analyzer] Fix the checker for the performance anti-pattern to accept messagesGeorge Karpenkov2018-03-071-11/+14
| | | | | | | | send to ObjC objects. Differential Revision: https://reviews.llvm.org/D44170 llvm-svn: 326868
* Revert r326602, it caused PR36620.Nico Weber2018-03-072-10/+8
| | | | llvm-svn: 326862
* [analyzer] CStringChecker.cpp: Remove the duplicated check about null ↵Henry Wong2018-03-061-21/+0
| | | | | | | | | | | | | | | | dereference on dest-buffer or src-buffer. Summary: `CheckBufferAccess()` calls `CheckNonNull()`, so there are some calls to `CheckNonNull()` that are useless. Reviewers: dcoughlin, NoQ, xazax.hun, cfe-commits, george.karpenkov Reviewed By: NoQ Subscribers: szepet, rnkovacs, MTC, a.sidorin Differential Revision: https://reviews.llvm.org/D44075 llvm-svn: 326782
* [analyzer] [quickfix] Prevent a crash in NamedDecl::getName()George Karpenkov2018-03-061-2/+4
| | | | llvm-svn: 326755
* [analyzer] AST-matching checker to detect global central dispatch ↵George Karpenkov2018-03-052-0/+155
| | | | | | | | | | | | | performance anti-pattern rdar://37312818 NB: The checker does not care about the ordering of callbacks, see the relevant FIXME in tests. Differential Revision: https://reviews.llvm.org/D44059 llvm-svn: 326746
* [analyzer] Improves the logic of GenericTaintChecker identifying stdin.Henry Wong2018-03-051-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: GenericTaintChecker can't recognize stdin in some cases. The reason is that `if (PtrTy->getPointeeType() == C.getASTContext().getFILEType()` does not hold when stdin is encountered. My platform is ubuntu16.04 64bit, gcc 5.4.0, glibc 2.23. The definition of stdin is as follows: ``` __BEGIN_NAMESPACE_STD /* The opaque type of streams. This is the definition used elsewhere. */ typedef struct _IO_FILE FILE; ___END_NAMESPACE_STD ... /* The opaque type of streams. This is the definition used elsewhere. */ typedef struct _IO_FILE __FILE; ... /* Standard streams. */ extern struct _IO_FILE *stdin; /* Standard input stream. */ extern struct _IO_FILE *stdout; /* Standard output stream. */ extern struct _IO_FILE *stderr; /* Standard error output stream. */ ``` The type of stdin is as follows AST: ``` ElaboratedType 0xc911170'struct _IO_FILE'sugar `-RecordType 0xc911150'struct _IO_FILE' `-CXXRecord 0xc923ff0'_IO_FILE' ``` `C.getASTContext().GetFILEType()` is as follows AST: ``` TypedefType 0xc932710 'FILE' sugar |-Typedef 0xc9111c0 'FILE' `-ElaboratedType 0xc911170 'struct _IO_FILE' sugar `-RecordType 0xc911150 'struct _IO_FILE' `-CXXRecord 0xc923ff0 '_IO_FILE' ``` So I think it's better to use `getCanonicalType()`. Reviewers: zaks.anna, NoQ, george.karpenkov, a.sidorin Reviewed By: zaks.anna, a.sidorin Subscribers: a.sidorin, cfe-commits, xazax.hun, szepet, MTC Differential Revision: https://reviews.llvm.org/D39159 llvm-svn: 326709
* [analyzer] Don't throw NSNumberObjectConversion warning on object ↵George Karpenkov2018-03-021-2/+4
| | | | | | | | | | | | | | | initialization in if-expression ``` if (NSNumber* x = ...) ``` is a reasonable pattern in objc++, we should not warn on it. rdar://35152234 Differential Revision: https://reviews.llvm.org/D44044 llvm-svn: 326619
* [Attr] Fix parameter indexing for several attributesJoel E. Denny2018-03-022-8/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The patch fixes a number of bugs related to parameter indexing in attributes: * Parameter indices in some attributes (argument_with_type_tag, pointer_with_type_tag, nonnull, ownership_takes, ownership_holds, and ownership_returns) are specified in source as one-origin including any C++ implicit this parameter, were stored as zero-origin excluding any this parameter, and were erroneously printing (-ast-print) and confusingly dumping (-ast-dump) as the stored values. * For alloc_size, the C++ implicit this parameter was not subtracted correctly in Sema, leading to assert failures or to silent failures of __builtin_object_size to compute a value. * For argument_with_type_tag, pointer_with_type_tag, and ownership_returns, the C++ implicit this parameter was not added back to parameter indices in some diagnostics. This patch fixes the above bugs and aims to prevent similar bugs in the future by introducing careful mechanisms for handling parameter indices in attributes. ParamIdx stores a parameter index and is designed to hide the stored encoding while providing accessors that require each use (such as printing) to make explicit the encoding that is needed. Attribute declarations declare parameter index arguments as [Variadic]ParamIdxArgument, which are exposed as ParamIdx[*]. This patch rewrites all attribute arguments that are processed by checkFunctionOrMethodParameterIndex in SemaDeclAttr.cpp to be declared as [Variadic]ParamIdxArgument. The only exception is xray_log_args's argument, which is encoded as a count not an index. Differential Revision: https://reviews.llvm.org/D43248 llvm-svn: 326602
* Remove redundant casts. NFCGeorge Burgess IV2018-03-012-6/+6
| | | | | | | | | | | | | | | | | | | So I wrote a clang-tidy check to lint out redundant `isa`, `cast`, and `dyn_cast`s for fun. This is a portion of what it found for clang; I plan to do similar cleanups in LLVM and other subprojects when I find time. Because of the volume of changes, I explicitly avoided making any change that wasn't highly local and obviously correct to me (e.g. we still have a number of foo(cast<Bar>(baz)) that I didn't touch, since overloading is a thing and the cast<Bar> did actually change the type -- just up the class hierarchy). I also tried to leave the types we were cast<>ing to somewhere nearby, in cases where it wasn't locally obvious what we were dealing with before. llvm-svn: 326416
* [analyzer] Add a checker for mmap()s which are both writable and executable.Artem Dergachev2018-03-012-0/+88
| | | | | | | | | | | | | | | | | | | This is a security check that warns when both PROT_WRITE and PROT_EXEC are set during mmap(). If mmap()ed memory is both writable and executable, it makes it easier for the attacker to execute arbitrary code when contents of this memory are compromised. Some applications require such mmap()s though, such as different sorts of JIT. Re-applied after a revert in r324167. Temporarily stays in the alpha package because it needs a better way of determining macro values that are not immediately available in the AST. Patch by David Carlier! Differential Revision: https://reviews.llvm.org/D42645 llvm-svn: 326405
* [analyzer] UndefinedAssignmentChecker: Better warning message in implicit ctors.Artem Dergachev2018-02-271-6/+25
| | | | | | | | | | | | | | | | | | When a class forgets to initialize a field in the constructor, and then gets copied around, a warning is emitted that the value assigned to a specific field is undefined. When the copy/move constructor is implicit (not written out in the code) but not trivial (is not a trivial memory copy, eg. because members have an explicit copy constructor), the body of such constructor is auto-generated in the AST. In this case the checker's warning message is squeezed at the top of the class declaration, and it gets hard to guess which field is at fault. Fix the warning message to include the name of the field. Differential Revision: https://reviews.llvm.org/D43798 llvm-svn: 326258
* [analyzer] MallocChecker: Suppress false positives in shared pointers.Artem Dergachev2018-02-271-7/+56
| | | | | | | | | | | | | | | | | | Throw away MallocChecker warnings that occur after releasing a pointer within a destructor (or its callees) after performing C11 atomic fetch_add or fetch_sub within that destructor (or its callees). This is an indication that the destructor's class is likely a reference-counting pointer. The analyzer is not able to understand that the original reference count is usually large enough to avoid most use-after-frees. Even when the smart pointer is a local variable, we still have these false positives that this patch suppresses, because the analyzer doesn't currently support atomics well enough. Differential Revision: https://reviews.llvm.org/D43791 llvm-svn: 326249
* [analyzer] Only attempt to get the value of locations of known typeGeorge Karpenkov2018-02-271-1/+1
| | | | | | | | | | | | Fixes https://bugs.llvm.org/show_bug.cgi?id=36474 In general, getSVal API should be changed so that it does not crash on some non-obvious conditions. It should either be updated to require a type, or to return Optional<SVal>. Differential Revision: https://reviews.llvm.org/D43801 llvm-svn: 326233
OpenPOWER on IntegriCloud