summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Checkers
Commit message (Collapse)AuthorAgeFilesLines
* Make helper functions static or move them into anonymous namespaces. NFC.Benjamin Kramer2020-01-142-1/+4
|
* Fix "pointer is null" static analyzer warnings. NFCI.Simon Pilgrim2020-01-121-8/+9
| | | | Use cast<> instead of dyn_cast<> and move into its users where its dereferenced immediately.
* [analyzer] Add PlacementNewCheckerGabor Marton2020-01-102-0/+120
| | | | | | | | | | | | | | | | | | | | | | | | | | Summary: This checker verifies if default placement new is provided with pointers to sufficient storage capacity. Noncompliant Code Example: #include <new> void f() { short s; long *lp = ::new (&s) long; } Based on SEI CERT rule MEM54-CPP https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM54-CPP.+Provide+placement+new+with+properly+aligned+pointe This patch does not implement checking of the alignment. Reviewers: NoQ, xazax.hun Subscribers: mgorny, whisperity, xazax.hun, baloghadamsoftware, szepet, rnkovacs, a.sidorin, mikhail.ramalho, donat Tags: #clang Differential Revision: https://reviews.llvm.org/D71612
* [NFC] Fixes -Wrange-loop-analysis warningsMark de Wever2020-01-011-1/+1
| | | | | | This avoids new warnings due to D68912 adds -Wrange-loop-analysis to -Wall. Differential Revision: https://reviews.llvm.org/D71857
* [Analyzer] Fixes -Wrange-loop-analysis warningsMark de Wever2019-12-222-4/+4
| | | | | | This avoids new warnings due to D68912 adds -Wrange-loop-analysis to -Wall. Differential Revision: https://reviews.llvm.org/D71809
* [Analyzer] Use a reference in a range-based forMark de Wever2019-12-212-14/+14
| | | | | | | | This avoids unneeded copies when using a range-based for loops. This avoids new warnings due to D68912 adds -Wrange-loop-analysis to -Wall. Differential Revision: https://reviews.llvm.org/D70869
* [analyzer] Add path notes to FuchsiaHandleCheck.Gabor Horvath2019-12-201-3/+73
| | | | Differential Revision: https://reviews.llvm.org/D70725
* [analyzer] Add Fuchsia Handle checkerGabor Horvath2019-12-202-0/+487
| | | | | | | The checker can diagnose handle use after releases, double releases, and handle leaks. Differential Revision: https://reviews.llvm.org/D70470
* [analyzer] Add a syntactic security check for ObjC NSCoder API.Artem Dergachev2019-12-191-0/+68
| | | | | | | Method '-[NSCoder decodeValueOfObjCType:at:]' is not only deprecated but also a security hazard, hence a loud check. Differential Revision: https://reviews.llvm.org/D71728
* [analyzer] Teach MismatchedDealloc about initWithBytesNoCopy with deallocator.Artem Dergachev2019-12-181-0/+3
| | | | | | | | MallocChecker warns when memory is passed into -[NSData initWithBytesNoCopy] but isn't allocated by malloc(), because it will be deallocated by free(). However, initWithBytesNoCopy has an overload that takes an arbitrary block for deallocating the object. If such overload is used, it is no longer necessary to make sure that the memory is allocated by malloc().
* [analyzer] NonnullGlobalConstants: Add support for kCFNull.Artem Dergachev2019-12-181-1/+3
| | | | It's a singleton in CoreFoundation that always contains a non-null CFNullRef.
* [analyzer] Add support for namespaces to GenericTaintCheckerBorsik Gabor2019-12-151-58/+123
| | | | | | | | | | | | | This patch introduces the namespaces for the configured functions and also enables the use of the member functions. I added an optional Scope field for every configured function. Functions without Scope match for every function regardless of the namespace. Functions with Scope will match if the full name of the function starts with the Scope. Multiple functions can exist with the same name. Differential Revision: https://reviews.llvm.org/D70878
* [analyzer] CStringChecker: Fix a crash on unknown value passed to strlcat.Artem Dergachev2019-12-131-6/+5
| | | | | | Checkers should always account for unknown values. Also use a slightly more high-level API that naturally avoids the problem.
* [analyzer] Escape symbols conjured into specific regions during a ↵Gabor Horvath2019-12-111-0/+10
| | | | | | | | | | conservative EvalCall This patch introduced additional PointerEscape callbacks after conservative calls for output parameters. This should not really affect the current checkers but the upcoming FuchsiaHandleChecker relies on this heavily. Differential Revision: https://reviews.llvm.org/D71224
* [analyzer] LocalizationChecker: Fix a crash on synthesized accessor stubs.Artem Dergachev2019-12-111-1/+4
| | | | | | The checker was trying to analyze the body of every method in Objective-C @implementation clause but the sythesized accessor stubs that were introduced into it by 2073dd2d have no bodies.
* [analyzer] CStringChecker: Fix overly eager assumption that memcmp args overlap.Artem Dergachev2019-12-111-14/+13
| | | | | | | | | | | | | | | | | While analyzing code `memcmp(a, NULL, n);', where `a' has an unconstrained symbolic value, the analyzer was emitting a warning about the *first* argument being a null pointer, even though we'd rather have it warn about the *second* argument. This happens because CStringChecker first checks whether the two argument buffers are in fact the same buffer, in order to take the fast path. This boils down to assuming `a == NULL' to true. Then the subsequent check for null pointer argument "discovers" that `a' is null. Don't take the fast path unless we are *sure* that the buffers are the same. Otherwise proceed as normal. Differential Revision: https://reviews.llvm.org/D71322
* [analyzer] CStringChecker: Improve warning messages.Artem Dergachev2019-12-111-4/+7
| | | | Differential Revision: https://reviews.llvm.org/D71321
* [Analyzer] Iterator Checkers: Replace `UnknownVal` in comparison result by a ↵Adam Balogh2019-12-111-5/+15
| | | | | | | | | | | | | conjured value Sometimes the return value of a comparison operator call is `UnkownVal`. Since no assumptions can be made on `UnknownVal`, this leeds to keeping impossible execution paths in the exploded graph resulting in poor performance and false positives. To overcome this we replace unknown results of iterator comparisons by conjured symbols. Differential Revision: https://reviews.llvm.org/D70244
* [Analyzer] Iterator Modeling: Print Container Data and Iterator Positions ↵Adam Balogh2019-12-111-0/+55
| | | | | | | | | | | | when printing the Program State Debugging the Iterator Modeling checker or any of the iterator checkers is difficult without being able to see the relations between the iterator variables and their abstract positions, as well as the abstract symbols denoting the begin and the end of the container. This patch adds the checker-specific part of the Program State printing to the Iterator Modeling checker.
* [Analyzer][NFC] Iterator Checkers - Separate iterator modeling and the ↵Adam Balogh2019-12-118-1131/+1429
| | | | | | | | | | actual checkers A monolithic checker class is hard to maintain. This patch splits it up into a modeling part, the three checkers and a debug checker. The common functions are moved into a library. Differential Revision: https://reviews.llvm.org/D70320
* Remove Expr.h include from ASTContext.h, NFCReid Kleckner2019-12-064-2/+6
| | | | | | | ASTContext.h is popular, prune its includes. Expr.h brings in Attr.h, which is also expensive. Move BlockVarCopyInit to Expr.h to accomplish this.
* Add `QualType::hasAddressSpace`. NFC.Michael Liao2019-12-061-1/+1
| | | | | - Add that as a shorthand of <T>.getQualifiers().hasAddressSpace(). - Simplify related code.
* [Checkers] Added support for freopen to StreamChecker.Balázs Kéri2019-12-051-0/+45
| | | | | | | | | | | | | | Summary: Extend StreamChecker with a new evaluation function for API call 'freopen'. Reviewers: NoQ, baloghadamsoftware, Szelethus, martong Reviewed By: baloghadamsoftware, martong Subscribers: martong, rnkovacs, dkrupp, Szelethus, gamesh411, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D69948
* [NFCI] update formating for misleading indentation warningTyker2019-12-031-11/+10
| | | | | | | | Reviewers: xbolva00 Reviewed By: xbolva00 Differential Revision: https://reviews.llvm.org/D70861
* [analyzer] Add custom filter functions for GenericTaintCheckerBorsik Gabor2019-11-233-56/+112
| | | | | | | | | | | This patch is the last of the series of patches which allow the user to annotate their functions with taint propagation rules. I implemented the use of the configured filtering functions. These functions can remove taintedness from the symbols which are passed at the specified arguments to the filters. Differential Revision: https://reviews.llvm.org/D59516
* [NFC] Refactor representation of materialized temporariesTyker2019-11-191-2/+1
| | | | | | | | | | | | | | | Summary: this patch refactor representation of materialized temporaries to prevent an issue raised by rsmith in https://reviews.llvm.org/D63640#inline-612718 Reviewers: rsmith, martong, shafik Reviewed By: rsmith Subscribers: thakis, sammccall, ilya-biryukov, rnkovacs, arphaman, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D69360
* Revert "[NFC] Refactor representation of materialized temporaries"Nico Weber2019-11-171-1/+2
| | | | | | This reverts commit 08ea1ee2db5f9d6460fef1d79d0d1d1a5eb78982. It broke ./ClangdTests/FindExplicitReferencesTest.All on the bots, see comments on https://reviews.llvm.org/D69360
* [NFC] Refactor representation of materialized temporariesTyker2019-11-161-2/+1
| | | | | | | | | | | | | | | Summary: this patch refactor representation of materialized temporaries to prevent an issue raised by rsmith in https://reviews.llvm.org/D63640#inline-612718 Reviewers: rsmith, martong, shafik Reviewed By: rsmith Subscribers: rnkovacs, arphaman, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D69360
* Remove +x permission on some filesSylvestre Ledru2019-11-161-0/+0
|
* [analyzer] Nullability: Don't infer nullable when passing as nullable parameter.Artem Dergachev2019-11-081-5/+0
| | | | You can't really infer anything from that.
* Redeclare Objective-C property accessors inside the ObjCImplDecl in which ↵Adrian Prantl2019-11-081-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | they are synthesized. This patch is motivated by (and factored out from) https://reviews.llvm.org/D66121 which is a debug info bugfix. Starting with DWARF 5 all Objective-C methods are nested inside their containing type, and that patch implements this for synthesized Objective-C properties. 1. SemaObjCProperty populates a list of synthesized accessors that may need to inserted into an ObjCImplDecl. 2. SemaDeclObjC::ActOnEnd inserts forward-declarations for all accessors for which no override was provided into their ObjCImplDecl. This patch does *not* synthesize AST function *bodies*. Moving that code from the static analyzer into Sema may be a good idea though. 3. Places that expect all methods to have bodies have been updated. I did not update the static analyzer's inliner for synthesized properties to point back to the property declaration (see test/Analysis/Inputs/expected-plists/nullability-notes.m.plist), which I believed to be more bug than a feature. Differential Revision: https://reviews.llvm.org/D68108 rdar://problem/53782400
* [Analyzer] Checker for Debugging Iterator CheckersAdam Balogh2019-11-081-2/+155
| | | | | | | | | For white-box testing correct container and iterator modelling it is essential to access the internal data structures stored for container and iterators. This patch introduces a simple debug checkers called debug.IteratorDebugging to achieve this. Differential Revision: https://reviews.llvm.org/D67156
* [analyzer] PR41729: CStringChecker: Improve strlcat and strlcpy modeling.Artem Dergachev2019-11-071-135/+166
| | | | | | | | | | | - Fix false positive reports of strlcat. - The return value of strlcat and strlcpy is now correctly calculated. - The resulting string length of strlcat and strlcpy is now correctly calculated. Patch by Daniel Krupp! Differential Revision: https://reviews.llvm.org/D66049
* [clang][analyzer] Using CallDescription in StreamChecker.Balázs Kéri2019-10-311-254/+146
| | | | | | | | | | | | | | | | | | | Summary: Recognization of function names is done now with the CallDescription class instead of using IdentifierInfo. This means function name and argument count is compared too. A new check for filtering not global-C-functions was added. Test was updated. Reviewers: Szelethus, NoQ, baloghadamsoftware, Charusso Reviewed By: Szelethus, NoQ, Charusso Subscribers: rnkovacs, xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, donat.nagy, Charusso, dkrupp, Szelethus, gamesh411, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D67706
* BlockInCriticalSectionChecker - silence static analyzer dyn_cast null ↵Simon Pilgrim2019-10-131-1/+1
| | | | | | | | dereference warning. NFCI. The static analyzer is warning about a potential null dereference, but we should be able to use cast<> directly and if not assert will fire for us. llvm-svn: 374717
* [NFCI] Return PathSensitiveBugReport where appropriateAlex Langford2019-09-232-7/+10
| | | | | | | | | | Some compilers have trouble converting unique_ptr<PathSensitiveBugReport> to unique_ptr<BugReport> causing some functions to fail to compile. Changing the return type of the functions that fail to compile does not appear to have any issues. I ran into this issue building with clang 3.8 on Ubuntu 16.04. llvm-svn: 372668
* Move classes into anonymous namespaces. NFC.Benjamin Kramer2019-09-221-2/+2
| | | | llvm-svn: 372495
* Attempt to fix a windows buildbot failureKristof Umann2019-09-211-2/+2
| | | | llvm-svn: 372462
* Fix a documentation errorKristof Umann2019-09-201-1/+1
| | | | llvm-svn: 372419
* Reland '[analyzer][MallocChecker][NFC] Document and reorganize some functions'Kristof Umann2019-09-201-463/+720
| | | | | | Differential Revision: https://reviews.llvm.org/D54823 llvm-svn: 372414
* [analyzer][NFC] Fix inconsistent references to checkers as "checks"Kristof Umann2019-09-1212-70/+62
| | | | | | | | | | | | | | Traditionally, clang-tidy uses the term check, and the analyzer uses checker, but in the very early years, this wasn't the case, and code originating from the early 2010's still incorrectly refer to checkers as checks. This patch attempts to hunt down most of these, aiming to refer to checkers as checkers, but preserve references to callback functions (like checkPreCall) as checks. Differential Revision: https://reviews.llvm.org/D67140 llvm-svn: 371760
* [analyzer] NFC: Move PathDiagnostic classes to libAnalysis.Artem Dergachev2019-09-116-6/+6
| | | | | | | | | | | | At this point the PathDiagnostic, PathDiagnosticLocation, PathDiagnosticPiece structures no longer rely on anything specific to Static Analyzer, so we can move them out of it for everybody to use. PathDiagnosticConsumers are still to be handed off. Differential Revision: https://reviews.llvm.org/D67419 llvm-svn: 371661
* [analyzer] NFC: Move getStmt() and createEndOfPath() out of PathDiagnostic.Artem Dergachev2019-09-1112-24/+21
| | | | | | | | | | These static functions deal with ExplodedNodes which is something we don't want the PathDiagnostic interface to know anything about, as it's planned to be moved out of libStaticAnalyzerCore. Differential Revision: https://reviews.llvm.org/D67382 llvm-svn: 371659
* [analyzer] NFC: Re-implement stack hints as a side map in BugReport.Artem Dergachev2019-09-116-27/+23
| | | | | | | | | | That's one of the few random entities in the PathDiagnostic interface that are specific to the Static Analyzer. By moving them out we could let everybody use path diagnostics without linking against Static Analyzer. Differential Revision: https://reviews.llvm.org/D67381 llvm-svn: 371658
* [analyzer] NFC: Introduce sub-classes for path-sensitive and basic reports.Artem Dergachev2019-09-0967-209/+260
| | | | | | | | | | | | | Checkers are now required to specify whether they're creating a path-sensitive report or a path-insensitive report by constructing an object of the respective type. This makes BugReporter more independent from the rest of the Static Analyzer because all Analyzer-specific code is now in sub-classes. Differential Revision: https://reviews.llvm.org/D66572 llvm-svn: 371450
* Move prop-sink branch to monorepo.Gabor Borsik2019-09-081-29/+65
| | | | llvm-svn: 371342
* [analyzer] Add minimal support for fix-it hints.Artem Dergachev2019-09-062-34/+71
| | | | | | | | | | | | | | | | | | | | | | | | | | Allow attaching fixit hints to Static Analyzer BugReports. Fixits are attached either to the bug report itself or to its notes (path-sensitive event notes or path-insensitive extra notes). Add support for fixits in text output (including the default text output that goes without notes, as long as the fixit "belongs" to the warning). Add support for fixits in the plist output mode. Implement a fixit for the path-insensitive DeadStores checker. Only dead initialization warning is currently covered. Implement a fixit for the path-sensitive VirtualCall checker when the virtual method is not pure virtual (in this case the "fix" is to suppress the warning by qualifying the call). Both fixits are under an off-by-default flag for now, because they require more careful testing. Differential Revision: https://reviews.llvm.org/D65182 llvm-svn: 371257
* [analyzer] pr43179: Make CallDescription defensive against C variadic functions.Artem Dergachev2019-09-061-1/+3
| | | | | | | | | | | | | | | | | | | | | Most functions that our checkers react upon are not C-style variadic functions, and therefore they have as many actual arguments as they have formal parameters. However, it's not impossible to define a variadic function with the same name. This will crash any checker that relies on CallDescription to check the number of arguments but silently assumes that the number of parameters is the same. Change CallDescription to check both the number of arguments and the number of parameters by default. If we're intentionally trying to match variadic functions, allow specifying arguments and parameters separately (possibly omitting any of them). For now we only have one CallDescription which would make use of those, namely __builtin_va_start itself. Differential Revision: https://reviews.llvm.org/D67019 llvm-svn: 371256
* Unbreak the build after r370798Benjamin Kramer2019-09-031-1/+1
| | | | llvm-svn: 370807
* [analyzer] NonNullParamChecker and CStringChecker parameter number in ↵Kristof Umann2019-09-032-24/+35
| | | | | | | | | | | | | | | | | | | | checker message There are some functions which can't be given a null pointer as parameter either because it has a nonnull attribute or it is declared to have undefined behavior (e.g. strcmp()). Sometimes it is hard to determine from the checker message which parameter is null at the invocation, so now this information is included in the message. This commit fixes https://bugs.llvm.org/show_bug.cgi?id=39358 Reviewed By: NoQ, Szelethus, whisperity Patch by Tibor Brunner! Differential Revision: https://reviews.llvm.org/D66333 llvm-svn: 370798
OpenPOWER on IntegriCloud