aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer/Checkers
AgeCommit message (Collapse)Author
2012-02-04[analyzer] Minor cleanups to the ObjCSelfInitChecker.Anna Zaks
(Also renames in other ObjC checkers to create one category of checks.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149745 91177308-0d34-0410-b5e6-96231b3b80d8
2012-02-02[analyzer] Fix a false positive in the CFArrayCreate check that surfacesAnna Zaks
the the code like this (due to x and &x being the same value but different size): void* x[] = { ptr1, ptr2, ptr3 }; CFArrayCreate(NULL, (const void **) &x, count, NULL); git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149579 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-31Fix an assertion failure in isMacOSXVersionLT for IOS targets.Bob Wilson
Check if the triple OS is IOS instead of checking for arm/thumb architectures and check that before calling isMacOSXVersionLT. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149454 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-31[analyzer] Add checks for common anti-patterns in strncat.Anna Zaks
(Since this is syntax only, might be a good candidate for turning into a compiler warning.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149407 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-31[analyzer] Change the warning to suggest 'strlcat/strlcpy' asAnna Zaks
replacements for 'starcat/strcpy' instead of 'strncat/strncpy'. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149406 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-31Convert checker over to using ProgramStateRef.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149319 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-30[analyzer] Rename the checker as per Ted's comment. Remove the referenceAnna Zaks
from the driver. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149276 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-30[analyzer] Make osx.cocos.CFContainersSyntax a default checker.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149258 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-30[analyzer] Add index out of bounds check for CFArrayGetArrayAtIndex.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149228 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-28StaticAnalyzer: Move ObjC- and CXX-specific methods out of line so checkers ↵Benjamin Kramer
that don't care about the language don't have to pull in all the headers. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149178 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-26Change references to 'const ProgramState *' to typedef 'ProgramStateRef'.Ted Kremenek
At this point this is largely cosmetic, but it opens the door to replace ProgramStateRef with a smart pointer that more eagerly acts in the role of reclaiming unused ProgramState objects. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149081 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-26StaticAnalyzer/Checkers: Fix CMake build.NAKAMURA Takumi
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149009 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-26[analyzer] Add an AST checker that checks for a common pitfall whenAnna Zaks
using CFArrayCreate & family. Specifically, CFArrayCreate's input should be: 'A C array of the pointer-sized values to be in the new array.' (radar://10717339) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@149008 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-24[analyzer] Add more C taint sources/sinks.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148844 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-21[analyzer] It's possible to have a non PointerType expression evaluate to a ↵Anna Zaks
Loc value. When this happens, use the default type. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148631 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-21[analyzer] Make VLA checker taint aware. Anna Zaks
Also, slightly modify the diagnostic message in ArrayBound and DivZero (still use 'taint', which might not mean much to the user, but plan on changing it later). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148626 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-20More dead code removal (using -Wunreachable-code)David Blaikie
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148577 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-20[analyzer] Add taint awareness to DivZeroChecker.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148566 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-20Reenable DeadStoresChecker under --analyze, and move the ↵Ted Kremenek
IdempotentOperationsChecker to the 'experimental' category. Fixes <rdar://problem/10146347>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148533 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-20Implement checker that looks for calls to mktemps and friends that have ↵Ted Kremenek
fewer than 6 Xs. Implements <rdar://problem/6336672>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148531 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-20Turn 'SecuritySyntaxChecker' into a "meta" security checker for insecure ↵Ted Kremenek
APIs. Now multiple checks are exposed as separate checkers, but CheckerManager only creates one Checker object. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148525 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-20[analyzer] Add socket API as a source of taint.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148518 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-18[analyzer] Refactor: prePropagateTaint ->Anna Zaks
TaintPropagationRule::process(). Also remove the "should be a pointer argument" warning - should be handled elsewhere. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148372 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-18[analyzer] Taint: warn when tainted data is used to specify a bufferAnna Zaks
size (Ex: in malloc, memcpy, strncpy..) (Maybe some of this could migrate to the CString checker. One issue with that is that we might want to separate security issues from regular API misuse.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148371 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-18[analyzer] Taint: add taint propagation rules for string and memory copyAnna Zaks
functions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148370 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-17Remove unreachable code in Clang. (replace with llvm_unreachable where ↵David Blaikie
appropriate or when GCC requires it) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148292 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-17Remove unnecessary default cases in switches over enums.David Blaikie
This allows -Wswitch-enum to find switches that need updating when these enums are modified. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148281 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-17[analyzer] Taint: generalize taint propagation to simplify adding moreAnna Zaks
taint propagation functions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148266 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-14[analyzer] Taint: add system and popen as undesirable sinks for taintAnna Zaks
data. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148176 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-13[analyzer] Taint: when looking up a binding, provide the type.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148080 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-12[analyzer] Rename Store::Retrieve() -> getBinding().Anna Zaks
+ all the other Retrieve..() methods + a comment for ElementRegion. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148011 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-12[analyzer] Add taint transfer by strcpy & others (part 1).Anna Zaks
To simplify the process: Refactor taint generation checker to simplify passing the information on which arguments need to be tainted from pre to post visit. Todo: We need to factor out the code that sema is using to identify the string and memcpy functions and use it here and in the CString checker. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148010 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-11"This change adds alloca/valloc checks to UnixAPIChecker. It includes a ↵Ted Kremenek
small refactoring for the common *alloc functions as well as a few tiny wibbles (adds a note to CWE/CERT advisory numbers in the bug output, and fixes a couple 80-column-wide violations.)" Patch by Austin Seipp! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147931 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-07Remove unused variable.Rafael Espindola
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147744 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-07[analyzer] Add basic format string vulnerability checking.Anna Zaks
We already have a more conservative check in the compiler (if the format string is not a literal, we warn). Still adding it here for completeness and since this check is stronger - only triggered if the format string is tainted. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147714 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-06[analyzer] Make the entries in 'Environment' context-sensitive by making ↵Ted Kremenek
entries map from (Stmt*,LocationContext*) pairs to SVals instead of Stmt* to SVals. This is needed to support basic IPA via inlining. Without this, we cannot tell if a Stmt* binding is part of the current analysis scope (StackFrameContext) or part of a parent context. This change introduces an uglification of the use of getSVal(), and thus takes two steps forward and one step back. There are also potential performance implications of enlarging the Environment. Both can be addressed going forward by refactoring the APIs and optimizing the internal representation of Environment. This patch mainly introduces the functionality upon when we want to build upon (and clean up). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147688 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-04[analyzer] Be less pessimistic about invalidation of global variablesAnna Zaks
as a result of a call. Problem: Global variables, which come in from system libraries should not be invalidated by all calls. Also, non-system globals should not be invalidated by system calls. Solution: The following solution to invalidation of globals seems flexible enough for taint (does not invalidate stdin) and should not lead to too many false positives. We split globals into 3 classes: * immutable - values are preserved by calls (unless the specific global is passed in as a parameter): A : Most system globals and const scalars * invalidated by functions defined in system headers: B: errno * invalidated by all other functions (note, these functions may in turn contain system calls): B: errno C: all other globals (which are not in A nor B) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147569 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-04Fix 80 col violations.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147566 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-04Minor code formatting cleanups.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147505 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-03Enhance UnixAPIChecker to also warn about zero-sized allocations to calloc() ↵Ted Kremenek
and realloc(). Patch by Cyril Roelandt! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147500 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-03Add initial version of checker to check if virtual member functions are ↵Ted Kremenek
called transitively from C++ constructors or destructors. Checker by Lei Zhang with a few tweaks by Ted Kremenek. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147494 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-29Fix cmake build with -DBUILD_SHARED_LIBS=ON.Rafael Espindola
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147338 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-22Colorize and condense CFG pretty-printing.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147203 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-22Fix typos in analyzer diagnostics pointed out by Matt Beaumont-Gay and ↵Ted Kremenek
Robert Purves. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147139 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-17[analyzer] Add support for taint flowing through a function (atoi).Anna Zaks
Check if the input parameters are tainted (or point to tainted data) on a checkPreStmt<CallExpr>. If the output should be tainted, record it in the state. On post visit (checkPostStmt<CallExpr>), use the state to make decisions (in addition to the existing logic). Use this logic for atoi and fscanf. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146793 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-16[analyzer] Better stdin support.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146748 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-14[analyzer] Treat stdin as a source of taint.Anna Zaks
Some of the test cases do not currently work because the analyzer core does not seem to call checkers for pre/post DeclRefExpr visits. (Opened radar://10573500. To be fixed later on.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146536 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-14[analyzer] Mark output of fscanf and fopen as tainted.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146533 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-14[analyzer] Mark getenv output as tainted.Anna Zaks
Also, allow adding taint to a region (not only a symbolic value). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146532 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-11[analyzer] CStringChecker should not rely on the analyzer generating ↵Anna Zaks
UndefOrUnknown value when it cannot reason about the expression. We are now often generating expressions even if the solver is not known to be able to simplify it. This is another cleanup of the existing code, where the rest of the analyzer and checkers should not base their logic on knowing ahead of the time what the solver can reason about. In this case, CStringChecker is performing a check for overflow of 'left+right' operation. The overflow can be checked with either 'maxVal-left' or 'maxVal-right'. Previously, the decision was based on whether the expresion evaluated to undef or not. With this patch, we check if one of the arguments is a constant, in which case we know that 'maxVal-const' is easily simplified. (Another option is to use canReasonAbout() method of the solver here, however, it's currently is protected.) This patch also contains 2 small bug fixes: - swap the order of operators inside SValBuilder::makeGenericVal. - handle a case when AddeVal is unknown in GenericTaintChecker::getPointedToSymbol. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146343 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2025-09-21 06:08:49 +0000