summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer
Commit message (Collapse)AuthorAgeFilesLines
* [Analyzer] Quick Fix for exponential execution time when simpilifying ↵Adam Balogh2018-07-232-9/+12
| | | | | | | | | | | | | | | | | | complex additive expressions Patch https://reviews.llvm.org/rC329780 not only rearranges comparisons but also binary expressions. This latter behavior is not protected by the analyzer option. Hower, since no complexity threshold is enforced to the symbols this may result in exponential execution time if the expressions are too complex: https://bugs.llvm.org/show_bug.cgi?id=38208. For a quick fix we extended the analyzer option to also cover the additive cases. This is only a temporary fix, the final solution should be enforcing the complexity threshold to the symbols. Differential Revision: https://reviews.llvm.org/D49536 llvm-svn: 337678
* [CStringSyntaxChecker] Fix build bot builds != x86 archsDavid Carlier2018-07-201-8/+9
| | | | | | | | | | Reviewers: NoQ,george.karpenkov Reviewed By: NoQ Differential Revision: https://reviews.llvm.org/D49588 llvm-svn: 337611
* [analyzer] Rename DanglingInternalBufferChecker to InnerPointerChecker.Reka Kovacs2018-07-204-35/+34
| | | | | | Differential Revision: https://reviews.llvm.org/D49553 llvm-svn: 337559
* Change \t to spacesFangrui Song2018-07-202-2/+2
| | | | llvm-svn: 337530
* [CStringSyntaxChecker] Check strlcpy sizeof syntaxDavid Carlier2018-07-191-0/+62
| | | | | | | | | | | | | | | | | The last argument is expected to be the destination buffer size (or less). Detects if it points to destination buffer size directly or via a variable. Detects if it is an integral, try to detect if the destination buffer can receive the source length. Updating bsd-string.c unit tests as it make it fails now. Reviewers: george.karpenpov, NoQ Reviewed By: george.karpenkov Differential Revision: https://reviews.llvm.org/D48884 llvm-svn: 337499
* [analyzer] Fix memory sanitizer error in MallocChecker.Reka Kovacs2018-07-191-3/+3
| | | | | | | | StringRef's data() returns a string that may be non-null-terminated. Switch to using StringRefs from const char pointers in visitor notes to avoid problems. llvm-svn: 337474
* [analyzer] Memoize complexity of SymExprMikhail R. Gadelha2018-07-192-8/+1
| | | | | | | | | | | | | | | | | Summary: This patch introduces a new member to SymExpr, which stores the symbol complexity, avoiding recalculating it every time computeComplexity() is called. Also, increase the complexity of conjured Symbols by one, so it's clear that it has a greater complexity than its underlying symbols. Reviewers: NoQ, george.karpenkov Reviewed By: NoQ, george.karpenkov Subscribers: xazax.hun, szepet, a.sidorin Differential Revision: https://reviews.llvm.org/D49232 llvm-svn: 337472
* [analyzer] Fix disappearing notes in DanglingInternalBufferChecker testsReka Kovacs2018-07-191-2/+3
| | | | | | Correct a mistake of the exact same kind I am writing this checker for. llvm-svn: 337466
* [analyzer] Add support for more basic_string API inReka Kovacs2018-07-192-11/+71
| | | | | | | | | | | | | DanglingInternalBufferChecker. A pointer referring to the elements of a basic_string may be invalidated by calling a non-const member function, except operator[], at, front, back, begin, rbegin, end, and rend. The checker now warns if the pointer is used after such operations. Differential Revision: https://reviews.llvm.org/D49360 llvm-svn: 337463
* [analyzer] Remove a debug print that was accidentally left around.Artem Dergachev2018-07-181-1/+0
| | | | | | No functional change intended. llvm-svn: 337417
* [analyzer] Fix Z3 backend after D48205Mikhail R. Gadelha2018-07-171-30/+29
| | | | | | | | | | | | | | | | | Summary: An assertion was added in D48205 to catch places where a `nonloc::SymbolVal` was wrapping a `loc` object. This patch fixes that in the Z3 backend by making the `SValBuilder` object accessible from inherited instances of `SimpleConstraintManager` and calling `SVB.makeSymbolVal(foo)` instead of `nonloc::SymbolVal(foo)`. Reviewers: NoQ, george.karpenkov Reviewed By: NoQ Subscribers: xazax.hun, szepet, a.sidorin Differential Revision: https://reviews.llvm.org/D49430 llvm-svn: 337304
* [analyzer] pr37802: Fix symbolic-pointer-to-boolean casts during load.Artem Dergachev2018-07-171-1/+2
| | | | | | | | | The canonical representation of pointer &SymRegion{$x} casted to boolean is "$x != 0", not "$x". Assertion added in r337227 catches that. Differential Revision: https://reviews.llvm.org/D48232 llvm-svn: 337228
* [analyzer] Assert that nonloc::SymbolVal always wraps a non-Loc-type symbol.Artem Dergachev2018-07-171-1/+1
| | | | | | | | | | | | | | | In the current SVal hierarchy there are multiple ways of representing certain values but few are actually used and expected to be seen by the code. In particular, a value of a symbolic pointer is always represented by a loc::MemRegionVal that wraps a SymbolicRegion that wraps the pointer symbol and never by a nonloc::SymbolVal that wraps that symbol directly. Assert the aforementioned fact. Fix one minor violation of it. Differential Revision: https://reviews.llvm.org/D48205 llvm-svn: 337227
* [analyzer] Make checkEndFunction() give access to the return statement.Reka Kovacs2018-07-1611-21/+28
| | | | | | Differential Revision: https://reviews.llvm.org/D49387 llvm-svn: 337215
* [analyzer] Bugfix for an overly eager suppression for null pointer return ↵George Karpenkov2018-07-161-39/+60
| | | | | | | | | | | | | from macros. Only suppress those cases where the null which came from the macro is relevant to the bug, and was not overwritten in between. rdar://41497323 Differential Revision: https://reviews.llvm.org/D48856 llvm-svn: 337213
* [analyzer] Fix GCDAntipatternChecker to only fire when the semaphore is ↵George Karpenkov2018-07-161-1/+3
| | | | | | | | | | | | initialized to zero Initializing a semaphore with a different constant most likely signals a different intent rdar://41802552 Differential Revision: https://reviews.llvm.org/D48911 llvm-svn: 337212
* [analyzer] Fix the Z3 backend always generating unsigned APSIntMikhail R. Gadelha2018-07-161-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: In `toAPSInt`, the Z3 backend was not checking the variable `Int`'s type and was always generating unsigned `APSInt`s. This was found by accident when I removed: ``` llvm::APSInt ConvertedLHS, ConvertedRHS; QualType LTy, RTy; std::tie(ConvertedLHS, LTy) = fixAPSInt(*LHS); std::tie(ConvertedRHS, RTy) = fixAPSInt(*RHS); - doIntTypePromotion<llvm::APSInt, Z3ConstraintManager::castAPSInt>( - ConvertedLHS, LTy, ConvertedRHS, RTy); return BVF.evalAPSInt(BSE->getOpcode(), ConvertedLHS, ConvertedRHS); ``` And the `BasicValueFactory` started to complain about different `signedness`. Reviewers: george.karpenkov, NoQ, ddcc Reviewed By: ddcc Subscribers: xazax.hun, szepet, a.sidorin Differential Revision: https://reviews.llvm.org/D49305 llvm-svn: 337169
* [analyzer] Fix constraint being dropped when analyzing a program without ↵Mikhail R. Gadelha2018-07-163-15/+14
| | | | | | | | | | | | | | | | | | | | | | | taint tracking enabled Summary: This patch removes the constraint dropping when taint tracking is disabled. It also voids the crash reported in D28953 by treating a SymSymExpr with non pointer symbols as an opaque expression. Updated the regressions and verifying the big projects now; I'll update here when they're done. Based on the discussion on the mailing list and the patches by @ddcc. Reviewers: george.karpenkov, NoQ, ddcc, baloghadamsoftware Reviewed By: george.karpenkov Subscribers: delcypher, llvm-commits, rnkovacs, xazax.hun, szepet, a.sidorin, ddcc Differential Revision: https://reviews.llvm.org/D48650 llvm-svn: 337167
* [Analyzer] Mark `SymbolData` parts of iterator position as live in program ↵Adam Balogh2018-07-161-21/+33
| | | | | | | | | | | | | | state maps Marking a symbolic expression as live is non-recursive. In our checkers we either use conjured symbols or conjured symbols plus/minus integers to represent abstract position of iterators, so in this latter case we also must mark the `SymbolData` part of these symbolic expressions as live to prevent them from getting reaped. Differential Revision: https://reviews.llvm.org/D48764 llvm-svn: 337151
* [Analyzer] alpha.unix.cstring.OutOfBounds checker enable/disable fixAdam Balogh2018-07-131-6/+6
| | | | | | | | | | | | | | | | | | It was not possible to disable alpha.unix.cstring.OutOfBounds checker's reports since unix.Malloc checker always implicitly enabled the filter. Moreover if the checker was disabled from command line (-analyzer-disable-checker ..) the out of bounds warnings were nevertheless emitted under different checker names such as unix.cstring.NullArg, or unix.Malloc. This patch fixes the case sot that Malloc checker only enables implicitly the underlying modeling of strcpy, memcpy etc. but not the warning messages that would have been emmitted by alpha.unix.cstring.OutOfBounds Patch by: Dániel Krupp Differential Revision: https://reviews.llvm.org/D48831 llvm-svn: 337000
* [analyzer][UninitializedObjectChecker] Fixed captured lambda variable nameKristof Umann2018-07-131-18/+21
| | | | | | Differential Revision: https://reviews.llvm.org/D48291 llvm-svn: 336995
* [analyzer][UninitializedObjectChecker] Support for MemberPointerTypesKristof Umann2018-07-131-29/+11
| | | | | | Differential Revision: https://reviews.llvm.org/D48325 llvm-svn: 336994
* [analyzer][UninitializedObjectChecker] Moved non-member functions out of the ↵Kristof Umann2018-07-121-17/+17
| | | | | | | | | | | anonymous namespace As the code for the checker grew, it became increasinly difficult to see whether a function was global or statically defined. In this patch, anything that isn't a type declaration or definition was moved out of the anonymous namespace and is marked as static. llvm-svn: 336901
* [analyzer] Track multiple raw pointer symbols in DanglingInternalBufferChecker.Reka Kovacs2018-07-111-18/+50
| | | | | | | | | | | | Previously, the checker only tracked one raw pointer symbol for each container object. But member functions returning a pointer to the object's inner buffer may be called on the object several times. These pointer symbols are now collected in a set inside the program state map and thus all of them is checked for use-after-free problems. Differential Revision: https://reviews.llvm.org/D49057 llvm-svn: 336835
* [analyzer] Partial revert of https://reviews.llvm.org/D49050George Karpenkov2018-07-111-8/+7
| | | | llvm-svn: 336755
* [analyzer] Pass through all arguments from the registerChecker() to the ↵George Karpenkov2018-07-111-7/+8
| | | | | | | | | | checker constructor A lot of checkers could be cleaned up in a similar way Differential Revision: https://reviews.llvm.org/D49050 llvm-svn: 336753
* DR330: look through array types when forming the cv-decomposition of a type.Richard Smith2018-07-111-1/+5
| | | | | | | | | | This allows more qualification conversions, eg. conversion from 'int *(*)[]' -> 'const int *const (*)[]' is now permitted, along with all the consequences of that: more types are similar, more cases are permitted by const_cast, and conversely, fewer "casting away constness" cases are permitted by reinterpret_cast. llvm-svn: 336745
* [analyzer] Add option to set maximum symbol complexity thresholdMikhail R. Gadelha2018-07-102-1/+11
| | | | | | | | | | | | | | | | | | | Summary: This adds an option, max-symbol-complexity, so an user can set the maximum symbol complexity threshold. Note that the current behaviour is equivalent to max complexity = 0, when taint analysis is not enabled and tests show that in a number of tests, having complexity = 25 yields the same results as complexity = 10000. This patch was extracted and modified from Dominic Chen's patch, D35450. Reviewers: george.karpenkov, NoQ, ddcc Reviewed By: george.karpenkov Subscribers: xazax.hun, szepet, a.sidorin Differential Revision: https://reviews.llvm.org/D49093 llvm-svn: 336671
* [analyzer] Add support for data() in DanglingInternalBufferChecker.Reka Kovacs2018-07-071-5/+6
| | | | | | | | | DanglingInternalBufferChecker now tracks use-after-free problems related to the incorrect usage of std::basic_string::data(). Differential Revision: https://reviews.llvm.org/D48532 llvm-svn: 336497
* [analyzer] Highlight c_str() call in DanglingInternalBufferChecker.Reka Kovacs2018-07-073-10/+88
| | | | | | | | | | Add a bug visitor to DanglingInternalBufferChecker that places a note at the point where the dangling pointer was obtained. The visitor is handed over to MallocChecker and attached to the report there. Differential Revision: https://reviews.llvm.org/D48522 llvm-svn: 336495
* [analyzer] Fix -Wcovered-switch-default warning in MallocChecker.Reka Kovacs2018-07-071-1/+0
| | | | | | Remove unnecessary default case that caused buildbot failures. llvm-svn: 336493
* [analyzer] Highlight container object destruction in MallocChecker.Reka Kovacs2018-07-071-14/+46
| | | | | | | | | Extend MallocBugVisitor to place a note at the point where objects with AF_InternalBuffer allocation family are destroyed. Differential Revision: https://reviews.llvm.org/D48521 llvm-svn: 336489
* [analyzer][ctu] fix unsortable diagnosticsRafael Stahl2018-07-041-3/+7
| | | | | | | | | | | | | | Summary: In the provided test case the PathDiagnostic compare function was not able to find a difference. Reviewers: xazax.hun, NoQ, dcoughlin, george.karpenkov Reviewed By: george.karpenkov Subscribers: a_sidorin, szepet, rnkovacs, a.sidorin, mikhail.ramalho, cfe-commits Differential Revision: https://reviews.llvm.org/D48474 llvm-svn: 336275
* Factor out Clang's desired 8MB stack size constant from the variousRichard Smith2018-07-031-2/+2
| | | | | | places we hardcode it. llvm-svn: 336231
* [analyzer] Replace the vector of ConstraintSets by a single ConstraintSet ↵Mikhail R. Gadelha2018-06-291-15/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and a function to merge ConstraintSets Now, instead of adding the constraints when they are removed, this patch adds them when they first appear and, since we walk the bug report backward, it should be the last set of ranges generated by the CSA for a given symbol. These are the number before and after the patch: ``` Project | current | patch | tmux | 283.222 | 123.052 | redis | 614.858 | 400.347 | openssl | 308.292 | 307.149 | twin | 274.478 | 245.411 | git | 547.687 | 477.335 | postgresql | 2927.495 | 2002.526 | sqlite3 | 3264.305 | 1028.416 | ``` Major speedups in tmux and sqlite (less than half of the time), redis and postgresql were about 25% faster while the rest are basically the same. Reviewers: NoQ, george.karpenkov Reviewed By: george.karpenkov Subscribers: rnkovacs, xazax.hun, szepet, a.sidorin Differential Revision: https://reviews.llvm.org/D48565 llvm-svn: 336002
* [analyzer][UninitializedObjectChecker] Added a NotesAsWarnings flagKristof Umann2018-06-291-21/+53
| | | | | | | | | | In order to better support consumers of the plist output that don't parse note entries just yet, a 'NotesAsWarnings' flag was added. If it's set to true, all notes will be converted to warnings. Differential Revision: https://reviews.llvm.org/D48285 llvm-svn: 335964
* [analyzer] Fix wrong comparison generation of the ranges generated by the ↵Mikhail R. Gadelha2018-06-281-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | refutation manager The refutation manager is removing a true bug from the test in this patch. The problem is that the following constraint: ``` (conj_$1{struct o *}) - (reg_$3<int * r>): [-9223372036854775808, 0] ``` is encoded as: ``` (and (bvuge (bvsub $1 $3) #x8000000000000000) (bvule (bvsub $1 $3) #x0000000000000000)) ``` The issue is that unsigned comparisons (bvuge and bvule) are being generated instead of signed comparisons (bvsge and bvsle). When generating the expressions: ``` (conj_$1{p *}) - (reg_$3<int * r>) >= -9223372036854775808 ``` and ``` (conj_$1{p *}) - (reg_$3<int * r>) <= 0 ``` both -9223372036854775808 and 0 are casted to pointer type and `LTy->isSignedIntegerOrEnumerationType()` in `Z3ConstraintManager::getZ3BinExpr` only checks if the type is signed, not if it's a pointer. Reviewers: NoQ, george.karpenkov, ddcc Subscribers: rnkovacs, NoQ, george.karpenkov, ddcc, xazax.hun, szepet, a.sidorin Differential Revision: https://reviews.llvm.org/D48324 llvm-svn: 335926
* [Analyzer] Iterator Checker - Part 2: Increment, decrement operators and ↵Adam Balogh2018-06-281-31/+448
| | | | | | | | | | | | | ahead-of-begin checks Add handling of the begin() funcion of containers to the iterator checkers, together with the pre- and postfix ++ and -- operators of the iterators. This makes possible the checking of iterators dereferenced ahead of the begin of the container. Differential Revision: https://reviews.llvm.org/D32642 llvm-svn: 335835
* [Analyzer] Constraint Manager Negates DifferenceAdam Balogh2018-06-281-1/+68
| | | | | | | | If range [m .. n] is stored for symbolic expression A - B, then we can deduce the range for B - A which is [-n .. -m]. This is only true for signed types, unless the range is [0 .. 0]. Differential Revision: https://reviews.llvm.org/D35110 llvm-svn: 335814
* [analyzer] Remove redundant ';'.Artem Dergachev2018-06-281-1/+1
| | | | | | Fixes a compiler warning. No functionan change intended. llvm-svn: 335808
* [analyzer] Use sufficiently large types for index bounds calculation.Artem Dergachev2018-06-282-3/+3
| | | | | | | | | | | | | | | | | The ProgramState::assumeInBound() API is used by checkers to make an assumption that a certain array index is within the array's bounds (i.e. is greater than or equal to 0 and is less than the length of the array). When the type of the index was unspecified by the caller, it assumed that the type is 'int', which caused some indices and sizes to truncate during calculations. Use ArrayIndexTy by default instead, which is used by the analyzer to represent index types and is currently hardcoded to long long. Patch by Bevin Hansson! Differential Revision: https://reviews.llvm.org/D46944 llvm-svn: 335803
* [analyzer] Add support for pre-C++17 copy elision.Artem Dergachev2018-06-282-43/+150
| | | | | | | | | | | | | | | | r335795 adds copy elision information to CFG. This commit allows static analyzer to elide elidable copy constructors by constructing the objects that were previously subject to elidable copy directly in the target region of the copy. The chain of elided constructors may potentially be indefinitely long. This only happens when the object is being returned from a function which in turn is returned from another function, etc. NRVO is not supported yet. Differential Revision: https://reviews.llvm.org/D47671 llvm-svn: 335800
* [CFG] [analyzer] Simplify lifetime-extended temporary construction contexts.Artem Dergachev2018-06-281-8/+1
| | | | | | | | | | | | | | When a temporary object is materialized and through that obtain lifetime that is longer than the duration of the full-expression, it does not require a temporary object destructor; it will be destroyed in a different manner. Therefore it's not necessary to include CXXBindTemporaryExpr into the construction context for such temporary in the CFG only to make clients throw it away. Differential Revision: https://reviews.llvm.org/D47667 llvm-svn: 335798
* [analyzer] Re-enable lifetime extension for temporaries without destructors.Artem Dergachev2018-06-281-9/+7
| | | | | | | | | | | | | | | | When an object's class provides no destructor, it's less important to materialize that object properly because we don't have to model the destructor correctly, so previously we skipped the support for these syntax patterns. Additionally, fix support for construction contexts of "static temporaries" (temporaries that are lifetime-extended by static references) because it turned out that we only had tests for them without destructors, which caused us to regress when we re-introduced the construction context for such temporaries. Differential Revision: https://reviews.llvm.org/D47658 llvm-svn: 335796
* [CFG] [analyzer] Add construction contexts that explain pre-C++17 copy elision.Artem Dergachev2018-06-283-1/+12
| | | | | | | | | | | | | | | | Before C++17 copy elision was optional, even if the elidable copy/move constructor had arbitrary side effects. The elidable constructor is present in the AST, but marked as elidable. In these cases CFG now contains additional information that allows its clients to figure out if a temporary object is only being constructed so that to pass it to an elidable constructor. If so, it includes a reference to the elidable constructor's construction context, so that the client could elide the elidable constructor and construct the object directly at its final destination. Differential Revision: https://reviews.llvm.org/D47616 llvm-svn: 335795
* Revert "[Analyzer] Moved RangeConstraintManager to header. NFC."Mikhail R. Gadelha2018-06-271-0/+83
| | | | | | | | This broke a number of bots. This reverts commit 5e1a89912d37a21c3b49ccf30600d7f498dffa9c. llvm-svn: 335752
* [analyzer] Allow registering custom statically-linked analyzer checkersAlexander Kornienko2018-06-272-6/+18
| | | | | | | | | | | | | | | | | | Summary: Add an extension point to allow registration of statically-linked Clang Static Analyzer checkers that are not a part of the Clang tree. This extension point employs the mechanism used when checkers are registered from dynamically loaded plugins. Reviewers: george.karpenkov, NoQ, xazax.hun, dcoughlin Reviewed By: george.karpenkov Subscribers: mgorny, mikhail.ramalho, rnkovacs, xazax.hun, szepet, a.sidorin, cfe-commits Differential Revision: https://reviews.llvm.org/D45718 llvm-svn: 335740
* [Analyzer] Moved RangeConstraintManager to header. NFC.Mikhail R. Gadelha2018-06-271-83/+0
| | | | | | | | | | | | | | Summary: While at it, added a dump method to RangeSet. Reviewers: george.karpenkov, NoQ Reviewed By: george.karpenkov Subscribers: xazax.hun, szepet, a.sidorin Differential Revision: https://reviews.llvm.org/D48561 llvm-svn: 335726
* [analyzer] [NFC] A convenient getter for getting a current stack frameGeorge Karpenkov2018-06-2719-66/+61
| | | | | | Differential Revision: https://reviews.llvm.org/D44756 llvm-svn: 335701
* [analyzer] Minor cleanups for BugReporter, expose a getter for AnalyzerOptions.George Karpenkov2018-06-261-10/+4
| | | | llvm-svn: 335683
OpenPOWER on IntegriCloud