summaryrefslogtreecommitdiffstats
path: root/clang/test/Analysis/malloc.c
Commit message (Collapse)AuthorAgeFilesLines
* [analyzer]Revert part of r161511; suppresses leak false positives in C++Anna Zaks2013-02-061-18/+22
| | | | | | | | | | | This is a "quick fix". The underlining issue is that when a const pointer to a struct is passed into a function, we do not invalidate the pointer fields. This results in false positives that are common in C++ (since copy constructors are prevalent). (Silences two llvm false positives.) llvm-svn: 174468
* [analyzer] Fix test to work on non-LP64 systems.Jordan Rose2012-11-271-5/+8
| | | | | | Thanks for the original catch in r168303, Takumi. llvm-svn: 168671
* clang/test: Suppress two tests on LLP64 target, Windows x64.NAKAMURA Takumi2012-11-191-0/+2
| | | | llvm-svn: 168303
* [analyzer] Report leaks at the closing brace of a function body.Jordan Rose2012-11-151-29/+30
| | | | | | | | | | | | | | | | | | | | This fixes a few cases where we'd emit path notes like this: +---+ 1| v p = malloc(len); ^ |2 +---+ In general this should make path notes more consistent and more correct, especially in cases where the leak happens on the false branch of an if that jumps directly to the end of the function. There are a couple places where the leak is reported farther away from the cause; these are usually cases where there are several levels of nested braces before the end of the function. This still matches our current behavior for when there /is/ a statement after all the braces, though. llvm-svn: 168070
* [analyzer] Mark symbol values as dead in the environment.Jordan Rose2012-11-151-0/+5
| | | | | | | | | | | | | | This allows us to properly remove dead bindings at the end of the top-level stack frame, using the ReturnStmt, if there is one, to keep the return value live. This in turn removes the need for a check::EndPath callback in leak checkers. This does cause some changes in the path notes for leak checkers. Previously, a leak would be reported at the location of the closing brace in a function. Now, it gets reported at the last statement. This matches the way leaks are currently reported for inlined functions, but is less than ideal for both. llvm-svn: 168066
* [analyzer] Fix another false positive in malloc realloc logic.Anna Zaks2012-09-121-0/+10
| | | | llvm-svn: 163749
* Adjust some analyzer tests to place widely shared inputs inside of anChandler Carruth2012-09-121-1/+1
| | | | | | | | | | | | | | | 'Inputs' subdirectory. The general desire has been to have essentially all of the non-test input files live in such directories, with some exceptions for obvious and common patterns like 'foo.c' using 'foo.h'. This came up because our distributed test runner couldn't find some of the headers, for example with stl.cpp. No functionality changed, just shuffling around here. llvm-svn: 163674
* Fix analyzer tests.Ted Kremenek2012-08-241-1/+1
| | | | llvm-svn: 162588
* [analyzer] Fix realloc related bug in the malloc checker.Anna Zaks2012-08-241-5/+14
| | | | | | | When reallocation of a non-allocated (not owned) symbol fails do not expect it to be freed. llvm-svn: 162533
* Allow multiple PathDiagnosticConsumers to be used with a BugReporter at the ↵Ted Kremenek2012-08-161-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | same time. This fixes several issues: - removes egregious hack where PlistDiagnosticConsumer would forward to HTMLDiagnosticConsumer, but diagnostics wouldn't be generated consistently in the same way if PlistDiagnosticConsumer was used by itself. - emitting diagnostics to the terminal (using clang's diagnostic machinery) is no longer a special case, just another PathDiagnosticConsumer. This also magically resolved some duplicate warnings, as we now use PathDiagnosticConsumer's diagnostic pruning, which has scope for the entire translation unit, not just the scope of a BugReporter (which is limited to a particular ExprEngine). As an interesting side-effect, diagnostics emitted to the terminal also have their trailing "." stripped, just like with diagnostics emitted to plists and HTML. This required some tests to be updated, but now the tests have higher fidelity with what users will see. There are some inefficiencies in this patch. We currently generate the report graph (from the ExplodedGraph) once per PathDiagnosticConsumer, which is a bit wasteful, but that could be pulled up higher in the logic stack. There is some intended duplication, however, as we now generate different PathDiagnostics (for the same issue) for different PathDiagnosticConsumers. This is necessary to produce the diagnostics that a particular consumer expects. llvm-svn: 162028
* [analyzer] Clean up the printing of FieldRegions for leaks.Jordan Rose2012-08-081-3/+9
| | | | | | | | | | | | | | Unfortunately, generalized region printing is very difficult: - ElementRegions are used both for casting and as actual elements. - Accessing values through a pointer means going through an intermediate SymbolRegionValue; symbolic regions are untyped. - Referring to implicitly-defined variables like 'this' and 'self' could be very confusing if they come from another stack frame. We fall back to simply not printing the region name if we can't be sure it will print well. This will allow us to improve in the future. llvm-svn: 161512
* [analyzer] Track malloc'd regions stored in structs.Jordan Rose2012-08-081-25/+23
| | | | | | | | | | | The main blocker on this (besides the previous commit) was that ScanReachableSymbols was not looking through LazyCompoundVals. Once that was fixed, it's easy enough to clear out malloc data on return, just like we do when we bind to a global region. <rdar://problem/10872635> llvm-svn: 161511
* [analyzer] Malloc: remove assert since is not valid as of r161248Anna Zaks2012-08-041-0/+12
| | | | | | | We can be in the situation where we did not track the symbol before realloc was called on it. llvm-svn: 161294
* [analyzer] Malloc: track non-allocated but freed memoryAnna Zaks2012-08-031-3/+11
| | | | | | | | | | There is no reason why we should not track the memory which was not allocated in the current function, but was freed there. This would allow to catch more use-after-free and double free with no/limited IPA. Also fix a realloc issue which surfaced as the result of this patch. llvm-svn: 161248
* [analyzer] Move the last bits of CallOrObjCMessage over to CallEvent.Jordan Rose2012-07-021-0/+12
| | | | | | | | | | | | | This involved refactoring some common pointer-escapes code onto CallEvent, then having MallocChecker use those callbacks for whether or not to consider a pointer's /ownership/ as escaping. This still needs to be pinned down, and probably we want to make the new argumentsMayEscape() function a little more discerning (content invalidation vs. ownership/metadata invalidation), but this is a good improvement. As a bonus, also remove CallOrObjCMessage from the source completely. llvm-svn: 159557
* [analyzer] Malloc leak false positive: Allow xpc context to escape.Anna Zaks2012-06-201-0/+13
| | | | llvm-svn: 158875
* [analyzer] Buffers passed to CGBitmapContextCreate can escape.Jordan Rose2012-06-161-0/+19
| | | | | | | | | | | | | | Specifically, although the bitmap context does not take ownership of the buffer (unlike CGBitmapContextCreateWithData), the data buffer can be extracted out of the created CGContextRef. Thus the buffer is not leaked even if its original pointer goes out of scope, as long as - the context escapes, or - it is retrieved via CGBitmapContextGetData and freed. Actually implementing that logic is beyond the current scope of MallocChecker, so for now CGBitmapContextCreate goes on our system function exception list. llvm-svn: 158579
* [analyze] Change some of the malloc tests to use clang_analyzer_eval.Anna Zaks2012-06-081-13/+8
| | | | | | Thanks, Jordan. llvm-svn: 158179
* [analyzer] Fixit for r158136.Anna Zaks2012-06-071-0/+17
| | | | | | | | | I falsely assumed that the memory spaces are equal when we reach this point, they might not be when memory space of one or more is stack or Unknown. We don't want a region from Heap space alias something with another memory space. llvm-svn: 158165
* [analyzer] Anti-aliasing: different heap allocations do not aliasAnna Zaks2012-06-071-4/+47
| | | | | | | | | | | | Add a concept of symbolic memory region belonging to heap memory space. When comparing symbolic regions allocated on the heap, assume that they do not alias. Use symbolic heap region to suppress a common false positive pattern in the malloc checker, in code that relies on malloc not returning the memory aliased to other malloc allocations, stack. llvm-svn: 158136
* [analyzer]Malloc: refactor and report use after free by memoryAnna Zaks2012-05-181-4/+8
| | | | | | allocating functions. llvm-svn: 157037
* [analyzer]Fixup r156134: Handle the case when FunctionDecl isn't avail.Anna Zaks2012-05-041-0/+6
| | | | llvm-svn: 156183
* [analyzer] Assume pointer escapes when a callback is passed insideAnna Zaks2012-05-031-0/+10
| | | | | | a struct. llvm-svn: 156135
* [analyzer] Allow pointers escape through calls containing callback args.Anna Zaks2012-05-031-0/+21
| | | | | | | (Since we don't have a generic pointer escape callback, modify ExprEngineCallAndReturn as well as the malloc checker.) llvm-svn: 156134
* [analyzer] Conjure a symbol to ensure we can identify pointer arithmeticAnna Zaks2012-05-031-0/+7
| | | | | | | | | | | | We need to identify the value of ptr as ElementRegion (result of pointer arithmetic) in the following code. However, before this commit '(2-x)' evaluated to Unknown value, and as the result, 'p + (2-x)' evaluated to Unknown value as well. int *p = malloc(sizeof(int)); ptr = p + (2-x); llvm-svn: 156052
* [analyzer] Revert the functional part of r155944. Anna Zaks2012-05-031-7/+0
| | | | | | | | The change resulted in multiple issues on the buildbot, so it's not ready for prime time. Only enable history tracking for tainted data(which is experimental) for now. llvm-svn: 156049
* [analyzer] Fix the 'ptr = ptr' false negative in the Malloc checker.Anna Zaks2012-05-021-0/+6
| | | | llvm-svn: 155963
* Teach SValBuilder to handle casts of symbolic pointer values to an integer ↵Ted Kremenek2012-05-011-0/+14
| | | | | | twice. Fixes <rdar://problem/11212866>. llvm-svn: 155950
* [analyzer] Test case reported for a reported false positive, now fixed.Anna Zaks2012-05-011-0/+9
| | | | llvm-svn: 155945
* [analyzer] Construct a SymExpr even when the constraint solver cannotAnna Zaks2012-05-011-0/+7
| | | | | | | | | | | | | | | | | | | | | | reason about the expression. This essentially keeps more history about how symbolic values were constructed. As an optimization, previous to this commit, we only kept the history if one of the symbols was tainted, but it's valuable keep the history around for other purposes as well: it allows us to avoid constructing conjured symbols. Specifically, we need to identify the value of ptr as ElementRegion (result of pointer arithmetic) in the following code. However, before this commit '(2-x)' evaluated to Unknown value, and as the result, 'p + (2-x)' evaluated to Unknown value as well. int *p = malloc(sizeof(int)); ptr = p + (2-x); This change brings 2% slowdown on sqlite. Fixes radar://11329382. llvm-svn: 155944
* [analyzer] check lazy bindings in RegionStore first before looking for ↵Ted Kremenek2012-04-261-0/+16
| | | | | | default values. Fixes <rdar://problem/11269741>. llvm-svn: 155615
* [analyzer] Malloc: Utter the name of the leaked variable.Anna Zaks2012-03-211-16/+16
| | | | | | | | | | | | | | | Specifically, we use the last store of the leaked symbol in the leak diagnostic. (No support for struct fields since the malloc checker doesn't track those yet.) + Infrastructure to track the regions used in store evaluations. This approach is more precise than iterating the store to obtain the region bound to the symbol, which is used in RetainCount checker. The region corresponds to what is uttered in the code in the last store and we do not rely on the store implementation to support this functionality. llvm-svn: 153212
* Teach SimpleSValBuilder that (in the absence of more information) stack ↵Ted Kremenek2012-03-051-0/+32
| | | | | | memory doesn't alias symbolic memory. This is a heuristic/hack, but works well in practice. Fixes <rdar://problem/10978247>. llvm-svn: 152065
* [analyzer] Malloc: A pointer might escape through CFContainers APIs,Anna Zaks2012-02-291-0/+43
| | | | | | | | | | | | funopen, setvbuf. Teach the checker and the engine about these APIs to resolve malloc false positives. As I am adding more of these APIs, it is clear that all this should be factored out into a separate callback (for example, region escapes). Malloc, KeyChainAPI and RetainRelease checkers could all use it. llvm-svn: 151737
* [analyzer] Malloc: unique leak reports by allocation site.Anna Zaks2012-02-231-2/+2
| | | | | | | | | When we find two leak reports with the same allocation site, report only one of them. Provide a helper method to BugReporter to facilitate this. llvm-svn: 151287
* [analyzer] Invalidate the region passed to pthread_setspecific() call.Anna Zaks2012-02-231-0/+10
| | | | | | | | | | | | | | | | | | Make this call an exception in ExprEngine::invalidateArguments: 'int pthread_setspecific(ptheread_key k, const void *)' stores a value into thread local storage. The value can later be retrieved with 'void *ptheread_getspecific(pthread_key)'. So even thought the parameter is 'const void *', the region escapes through the call. (Here we just blacklist the call in the ExprEngine's default logic. Another option would be to add a checker which evaluates the call and triggers the call to invalidate regions.) Teach the Malloc Checker, which treats all system calls as safe about the API. llvm-svn: 151220
* [analyzer] Malloc cleanup:Anna Zaks2012-02-221-0/+6
| | | | | | | | | | | | - We should not evaluate strdup in the Malloc Checker, it's the job of CString checker, so just update the RefState to reflect allocated memory. - Refactor to reduce LOC: remove some wrapper auxiliary functions, make all functions return the state and add the transition in one place (instead of in each auxiliary function). llvm-svn: 151188
* [analyzer] Malloc checker: mark 'strdup' and 'strndup' as allocators.Anna Zaks2012-02-221-0/+19
| | | | llvm-svn: 151124
* [analyzer] Malloc: fix another false positive.Anna Zaks2012-02-221-14/+31
| | | | | | | , when we return a symbol reachable to the malloced one via pointer arithmetic. llvm-svn: 151121
* [analyzer] Turn on by default the Malloc Checker and a couple of CStringAnna Zaks2012-02-201-1/+1
| | | | | | | | | | | | checks: - unix.Malloc - Checks for memory leaks, double free, use-after-free. - unix.cstring.NullArg - Checks for null pointers passed as arguments to CString functions + evaluates CString functions. - unix.cstring.BadSizeArg - Checks for common anti-patterns in strncat size argument. llvm-svn: 150988
* [analyzer] Malloc Checker more tests.Anna Zaks2012-02-171-0/+17
| | | | llvm-svn: 150847
* [analyzer] Fix another false positive in the Malloc Checker, by makingAnna Zaks2012-02-171-7/+20
| | | | | | | | | | | | it aware of CString APIs that return the input parameter. Malloc Checker needs to know how the 'strcpy' function is evaluated. Introduce the dependency on CStringChecker for that. CStringChecker knows all about these APIs. Addresses radar://10864450 llvm-svn: 150846
* [analyzer] MallocChecker: more tests.Anna Zaks2012-02-161-0/+15
| | | | llvm-svn: 150734
* [analyzer] Malloc Checker: Clean up bug naming:Anna Zaks2012-02-161-29/+29
| | | | | | | - Rename the category "Logic Error" -> "Memory Error". - Shorten all the messages. llvm-svn: 150733
* [analyzer] Malloc Checker: Give up when a pointer escapes into a struct.Anna Zaks2012-02-161-0/+35
| | | | | | | | We are not properly handling the memory regions that escape into struct fields, which led to a bunch of false positives. Be conservative here and give up when a pointer escapes into a struct. llvm-svn: 150658
* [analyzer] Malloc Checker: Add another false positive as a todo test.Anna Zaks2012-02-151-0/+14
| | | | llvm-svn: 150534
* [analyzer] Malloc Checker: add support for reallocf, which always freesAnna Zaks2012-02-151-0/+34
| | | | | | the passed in pointer on failure. llvm-svn: 150533
* [analyzer] Malloc Checker: add support for valloc + minor codeAnna Zaks2012-02-151-0/+13
| | | | | | hardening. llvm-svn: 150532
* [analyzer] Malloc Checker: realloc: add dependency between the symbolsAnna Zaks2012-02-141-0/+41
| | | | | | | | | | | | | in realloc map. If there is no dependency, the reallocated ptr will get garbage collected before we know that realloc failed, which would lead us to missing a memory leak warning. Also added new test cases, which we can handle now. Plus minor cleanups. llvm-svn: 150446
* [analyzer] Malloc Checker: realloc: correct the way we are handing theAnna Zaks2012-02-131-0/+51
| | | | | | case when size is 0. llvm-svn: 150412
OpenPOWER on IntegriCloud