aboutsummaryrefslogtreecommitdiff
path: root/include/clang/StaticAnalyzer/Core
AgeCommit message (Collapse)Author
2012-01-20[analyzer] Skip casts when determining taint dependencies + prettyAnna Zaks
printing. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148517 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-20[analyzer] Add a utility method that allows to find the macro name usedAnna Zaks
at the given location. This could be useful when checkers' logic depends on whether a function is called with a given macro argument. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148516 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-20[analyzer] Cleanup of Symbol dump methods.Anna Zaks
This solves a the issue of crashing gdb when dumping a symbol; + consistent vitualization. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148515 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-18[analyzer] Taint: add taint propagation rules for string and memory copyAnna Zaks
functions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148370 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-12[analyzer] fix inlining's handling of mapping actual to formal arguments and ↵Ted Kremenek
limit the call stack depth. The analyzer can now accurately simulate factorial for limited depths. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148036 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-12[analyzer] Rename Store::Retrieve() -> getBinding().Anna Zaks
+ all the other Retrieve..() methods + a comment for ElementRegion. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148011 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-10Make PathDiagnosticLocation more resilient to null Stmt pointers.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147854 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-07[analyzer] Add basic format string vulnerability checking.Anna Zaks
We already have a more conservative check in the compiler (if the format string is not a literal, we warn). Still adding it here for completeness and since this check is stronger - only triggered if the format string is tainted. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147714 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-07[analyzer] Remove CallEnterNodeBuilder and simplify ↵Ted Kremenek
ExprEngine::processCallEnter(). This removes analysis of other translation units, but that was an experimental feature anyway that we will revisit later. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147705 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-07[analyzer] Remove CallExitNodeBuilder, and have ↵Ted Kremenek
ExprEngine::processCallExit() do the work manually. This is a nice simplification. Along the way, fix Exprengine::processCallExit() to also perform the postStmt callback for checkers for CallExprs. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147697 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-06[analyzer] Make the entries in 'Environment' context-sensitive by making ↵Ted Kremenek
entries map from (Stmt*,LocationContext*) pairs to SVals instead of Stmt* to SVals. This is needed to support basic IPA via inlining. Without this, we cannot tell if a Stmt* binding is part of the current analysis scope (StackFrameContext) or part of a parent context. This change introduces an uglification of the use of getSVal(), and thus takes two steps forward and one step back. There are also potential performance implications of enlarging the Environment. Both can be addressed going forward by refactoring the APIs and optimizing the internal representation of Environment. This patch mainly introduces the functionality upon when we want to build upon (and clean up). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147688 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-04[analyzer] Be less pessimistic about invalidation of global variablesAnna Zaks
as a result of a call. Problem: Global variables, which come in from system libraries should not be invalidated by all calls. Also, non-system globals should not be invalidated by system calls. Solution: The following solution to invalidation of globals seems flexible enough for taint (does not invalidate stdin) and should not lead to too many false positives. We split globals into 3 classes: * immutable - values are preserved by calls (unless the specific global is passed in as a parameter): A : Most system globals and const scalars * invalidated by functions defined in system headers: B: errno * invalidated by all other functions (note, these functions may in turn contain system calls): B: errno C: all other globals (which are not in A nor B) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147569 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-04Extend ConditionBRVisitor to handle condition variable assignments.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147526 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-22Delete stray semicolon.Eli Friedman
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147140 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-20[analyzer] Do not invalidate arguments when the parameter'sAnna Zaks
type is a pointer to const. (radar://10595327) The regions corresponding to the pointer and reference arguments to a function get invalidated by the calls since a function call can possibly modify the pointed to data. With this change, we are not going to invalidate the data if the argument is a pointer to const. This change makes the analyzer more optimistic in reporting errors. (Support for C, C++ and Obj C) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147002 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-20Unweaken vtables as per ↵David Blaikie
http://llvm.org/docs/CodingStandards.html#ll_virtual_anch git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146959 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-17[analyzer] Minor: Simplify & assert.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146792 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-14[analyzer] Minor refactor to addTaint.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146535 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-10[analyzer]Fixup r146336.Anna Zaks
Forgot to commit the Header files. Rename generateUnknownVal -> makeGenericVal. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146337 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-09[analyzer] Fix inconsistency on when SValBuilder assumes that 2Anna Zaks
types are equivalent. + A taint test which tests bitwise operations and which was triggering an assertion due to presence of the integer to integer cast. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146240 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-08[analyzer] If memory region is tainted mark data as tainted.Anna Zaks
+ random comments git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146199 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-07[analyzer] Propagate taint through MemRegions.Anna Zaks
SVal can be not only a symbol, but a MemRegion. Add support for such cases. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146006 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-06[analyzer] Add comments related to symbol_iteratorAnna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145987 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-06[analyzer] Refactor: Move symbol_iterator from SVal to SymExpr, use itAnna Zaks
for finding dependent symbols for taint. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145986 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-06[analyzer] Propagate taint through NonLoc to NonLoc casts.Anna Zaks
- Created a new SymExpr type - SymbolCast. - SymbolCast is created when we don't know how to simplify a NonLoc to NonLoc casts. - A bit of code refactoring: introduced dispatchCast to have better code reuse, remove a goto. - Updated the test case to showcase the new taint flow. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145985 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-05[analyzer] Mark ConstraintManager::canReasonAbout as protected.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145857 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-05[analyzer] Unify SymbolVal and SymExprVal under a single SymbolValAnna Zaks
class. We are going into the direction of handling SymbolData and other SymExpr uniformly, so it makes less sense to keep two different SVal classes. For example, the checkers would have to take an extra step to reason about each type separately. The classes have the same members, we were just using the SVal kind field for easy differentiation in 3 switch statements. The switch statements look more ugly now, but we can make the code more readable in other ways, for example, moving some code into separate functions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145833 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-05[analyzer] Remove all uses of ConstraintManager::canResonAbout() fromAnna Zaks
ExprEngine. Teach SimpleConstraintManager::assumeSymRel() to propagate constraints to symbolic expressions. + One extra warning (real bug) is now generated due to enhanced assumeSymRel(). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145832 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-05[analyzer] First step toward removingAnna Zaks
ConstraintManager::canReasonAbout() from the ExprEngine. ExprEngine should not care if the constraint solver can reason about something or not. The solver should be able to handle all the SymExprs. To do this, the solver should be able to keep track of not only the SymbolData but of all SymExprs. This is why we change SymbolRef to be an alias of SymExpr*. When encountering an expression it cannot simplify, the solver should just add the constraints to it. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145831 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-05[analyzer] Add ability to do a simple ProgramState dump() withoutAnna Zaks
requiring CFG. Adding more ugly code; the evnvironment printing should be moved to envirnment at some point. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145828 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-01[analyzer] Refactor checkers to use helper function for getting callee Decl ↵Anna Zaks
and name. We are getting name of the called function or it's declaration in a few checkers. Refactor them to use the helper function in the CheckerContext. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145576 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-30[analyzer] Add checker callback documentation.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145495 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-28[analyzer] Minor cleanup of SValBuilder: Comments + code reuse.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145274 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-17[analyzer] Do not conjure a symbol when we need to propagate taint.Anna Zaks
When the solver and SValBuilder cannot reason about symbolic expressions (ex: (x+1)*y ), the analyzer conjures a new symbol with no ties to the past. This helps it to recover some path-sensitivity. However, this breaks the taint propagation. With this commit, we are going to construct the expression even if we cannot reason about it later on if an operand is tainted. Also added some comments and asserts. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144932 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-17[analyzer] Add a helper method.Anna Zaks
Naming could be improved.. But we should first rename the classes in the SVal hierarchy. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144927 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-17[analysis] Constify CheckerContext.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144871 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-17[analyzer] Put CheckerConext::getCalleeName out of line.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144870 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-16[analyzer] Adding basic building blocks for taint propagation.Anna Zaks
TaintTag.h will contain definitions of different taint kinds and their properties. TaintManager will be responsible for implementing taint specific operations, storing taint. ProgramState will provide API to add/remove taint. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144824 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-16[analyzer] Cleanup (NULL -> 0, no doxygen in cpp).Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144822 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-16[analyzer] Assert if we ever get an over constrained state.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144821 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-16[analyzer] Factor getCalleeName to the checker context.Anna Zaks
many checkers are trying to get a name of the callee when visiting a CallExpr, so provide a convenience API. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144820 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-01[analyzer] Make sink attribute part of the node profile.Anna Zaks
This prevents caching out on nodes with different sink flag. (This is a cleaner fix for radar://10376675). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143517 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-01[analyzer] Fix PR11282 - an assert in markAsSinkAnna Zaks
This is another fallout from the refactoring. We were calling MarkAsSink on a cached out node. (Fixes radar://10376675) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143516 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-01[analyzer] BranchNodeBuilder should not generate autotransitions.Anna Zaks
This fixes radar://10367606 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143514 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-01[analyzer] CheckerContext::getPredecessor() cleanupAnna Zaks
Remove unnecessary calls to CheckerContext::getPredecessor() + Comments. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143513 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-01[analyzer] Remove the CheckerContext's destructor.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143512 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-27[analyzer] Optimize by not generating empty transitions in CheckerContextAnna Zaks
Go not generate a new transition by addTransition methods if nothing changed. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143091 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-27[analyzer] Move enqueueEndOfFunction into CoreEngine.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143090 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-27[analyzer] Make CoreEngine responsible for enqueueing Stmt Nodes.Anna Zaks
Enqueue the nodes generated as the result of processing a statement inside the Core Engine. This makes sure ExpEngine does not access CoreEngine's private members and is more concise. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143089 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-26[analyzer] Add getLocationContext to CheckerContextAnna Zaks
CheckerContext::getPredecessor is only used to get to the LocationContext half of the times. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143061 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-06-29 08:39:20 +0000