| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
|
|
|
| |
printing.
llvm-svn: 148517
|
| |
|
|
|
|
|
|
|
| |
at the given location.
This could be useful when checkers' logic depends on whether a function
is called with a given macro argument.
llvm-svn: 148516
|
| |
|
|
|
|
|
|
|
| |
TaintPropagationRule::process().
Also remove the "should be a pointer argument" warning - should be
handled elsewhere.
llvm-svn: 148372
|
| |
|
|
|
|
|
|
|
|
| |
size (Ex: in malloc, memcpy, strncpy..)
(Maybe some of this could migrate to the CString checker. One issue
with that is that we might want to separate security issues from
regular API misuse.)
llvm-svn: 148371
|
| |
|
|
|
|
| |
functions.
llvm-svn: 148370
|
| |
|
|
|
|
| |
appropriate or when GCC requires it)
llvm-svn: 148292
|
| |
|
|
|
|
| |
This allows -Wswitch-enum to find switches that need updating when these enums are modified.
llvm-svn: 148281
|
| |
|
|
|
|
| |
taint propagation functions.
llvm-svn: 148266
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- Add atomic-to/from-nonatomic cast types
- Emit atomic operations for arithmetic on atomic types
- Emit non-atomic stores for initialisation of atomic types, but atomic stores and loads for every other store / load
- Add a __atomic_init() intrinsic which does a non-atomic store to an _Atomic() type. This is needed for the corresponding C11 stdatomic.h function.
- Enables the relevant __has_feature() checks. The feature isn't 100% complete yet, but it's done enough that we want people testing it.
Still to do:
- Make the arithmetic operations on atomic types (e.g. Atomic(int) foo = 1; foo++;) use the correct LLVM intrinsic if one exists, not a loop with a cmpxchg.
- Add a signal fence builtin
- Properly set the fenv state in atomic operations on floating point values
- Correctly handle things like _Atomic(_Complex double) which are too large for an atomic cmpxchg on some platforms (this requires working out what 'correctly' means in this context)
- Fix the many remaining corner cases
llvm-svn: 148242
|
| |
|
|
| |
llvm-svn: 148229
|
| |
|
|
|
|
| |
data.
llvm-svn: 148176
|
| |
|
|
|
|
| |
radar://10686991
llvm-svn: 148081
|
| |
|
|
| |
llvm-svn: 148080
|
| |
|
|
|
|
| |
looking up value at a CodeTextRegion even when the type is not provided.
llvm-svn: 148079
|
| |
|
|
| |
llvm-svn: 148078
|
| |
|
|
|
|
| |
limit the call stack depth. The analyzer can now accurately simulate factorial for limited depths.
llvm-svn: 148036
|
| |
|
|
|
|
| |
+ all the other Retrieve..() methods + a comment for ElementRegion.
llvm-svn: 148011
|
| |
|
|
|
|
|
|
|
|
|
|
| |
To simplify the process:
Refactor taint generation checker to simplify passing the
information on which arguments need to be tainted from pre to post
visit.
Todo: We need to factor out the code that sema is using to identify the
string and memcpy functions and use it here and in the CString checker.
llvm-svn: 148010
|
| |
|
|
|
|
|
|
|
|
|
|
| |
small refactoring for
the common *alloc functions as well as a few tiny wibbles (adds a note
to CWE/CERT advisory numbers in the bug output, and fixes a couple
80-column-wide violations.)"
Patch by Austin Seipp!
llvm-svn: 147931
|
| |
|
|
|
|
|
|
|
|
| |
inlining for straight C calls.
My hope is to reimplement this from first principles based on the simplifications of removing unneeded node builders
and re-evaluating how C++ calls are handled in the CFG. The hope is to turn inlining "on-by-default" as soon as possible
with a core set of things working well, and then expand over time.
llvm-svn: 147904
|
| |
|
|
| |
llvm-svn: 147854
|
| |
|
|
| |
llvm-svn: 147744
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
A patch by Dmitri Gribenko!
The attached patch fixes a use-after-free in AnalysisConsumer::HandleTranslationUnit. The problem is that
BugReporter's destructor runs after AnalysisManager has been already
deleted. The fix introduces a scope to force correct destruction
order.
A crash happens only when reports have been added in AnalysisConsumer::HandleTranslationUnit's BugReporter. We don't have such checkers in clang so no test.
llvm-svn: 147732
|
| |
|
|
|
|
|
|
|
| |
We already have a more conservative check in the compiler (if the
format string is not a literal, we warn). Still adding it here for
completeness and since this check is stronger - only triggered if the
format string is tainted.
llvm-svn: 147714
|
| |
|
|
|
|
|
|
| |
ExprEngine::processCallEnter().
This removes analysis of other translation units, but that was an experimental feature anyway that we will revisit later.
llvm-svn: 147705
|
| |
|
|
| |
llvm-svn: 147698
|
| |
|
|
|
|
|
|
| |
ExprEngine::processCallExit() do the work manually. This is a nice simplification.
Along the way, fix Exprengine::processCallExit() to also perform the postStmt callback for checkers for CallExprs.
llvm-svn: 147697
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
entries map from
(Stmt*,LocationContext*) pairs to SVals instead of Stmt* to SVals.
This is needed to support basic IPA via inlining. Without this, we cannot tell
if a Stmt* binding is part of the current analysis scope (StackFrameContext) or
part of a parent context.
This change introduces an uglification of the use of getSVal(), and thus takes
two steps forward and one step back. There are also potential performance implications
of enlarging the Environment. Both can be addressed going forward by refactoring the
APIs and optimizing the internal representation of Environment. This patch
mainly introduces the functionality upon when we want to build upon (and clean up).
llvm-svn: 147688
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
as a result of a call.
Problem:
Global variables, which come in from system libraries should not be
invalidated by all calls. Also, non-system globals should not be
invalidated by system calls.
Solution:
The following solution to invalidation of globals seems flexible enough
for taint (does not invalidate stdin) and should not lead to too
many false positives. We split globals into 3 classes:
* immutable - values are preserved by calls (unless the specific
global is passed in as a parameter):
A : Most system globals and const scalars
* invalidated by functions defined in system headers:
B: errno
* invalidated by all other functions (note, these functions may in
turn contain system calls):
B: errno
C: all other globals (which are not in A nor B)
llvm-svn: 147569
|
| |
|
|
| |
llvm-svn: 147566
|
| |
|
|
| |
llvm-svn: 147526
|
| |
|
|
| |
llvm-svn: 147505
|
| |
|
|
|
|
| |
and realloc(). Patch by Cyril Roelandt!
llvm-svn: 147500
|
| |
|
|
|
|
|
|
| |
called transitively
from C++ constructors or destructors. Checker by Lei Zhang with a few tweaks by Ted Kremenek.
llvm-svn: 147494
|
| |
|
|
| |
llvm-svn: 147338
|
| |
|
|
|
|
| |
clients. No functionality change.
llvm-svn: 147318
|
| |
|
|
| |
llvm-svn: 147203
|
| |
|
|
|
|
| |
Robert Purves.
llvm-svn: 147139
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
type is a pointer to const. (radar://10595327)
The regions corresponding to the pointer and reference arguments to
a function get invalidated by the calls since a function call can
possibly modify the pointed to data. With this change, we are not going
to invalidate the data if the argument is a pointer to const. This
change makes the analyzer more optimistic in reporting errors.
(Support for C, C++ and Obj C)
llvm-svn: 147002
|
| |
|
|
| |
llvm-svn: 146993
|
| |
|
|
| |
llvm-svn: 146967
|
| |
|
|
|
|
| |
http://llvm.org/docs/CodingStandards.html#ll_virtual_anch
llvm-svn: 146959
|
| |
|
|
|
|
|
|
|
|
| |
Check if the input parameters are tainted (or point to tainted data) on
a checkPreStmt<CallExpr>. If the output should be tainted, record it in
the state. On post visit (checkPostStmt<CallExpr>), use the state to
make decisions (in addition to the existing logic). Use this logic for
atoi and fscanf.
llvm-svn: 146793
|
| |
|
|
| |
llvm-svn: 146792
|
| |
|
|
| |
llvm-svn: 146748
|
| |
|
|
| |
llvm-svn: 146683
|
| |
|
|
|
|
|
|
|
| |
is deterministic.
Non-determinism was the reason for the test which caused the earlier
buildbot failures, so re-enable the test.
llvm-svn: 146628
|
| |
|
|
|
|
|
|
| |
Some of the test cases do not currently work because the analyzer core
does not seem to call checkers for pre/post DeclRefExpr visits.
(Opened radar://10573500. To be fixed later on.)
llvm-svn: 146536
|
| |
|
|
| |
llvm-svn: 146535
|
| |
|
|
| |
llvm-svn: 146533
|