aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer/Checkers
AgeCommit message (Collapse)Author
2012-01-17[analyzer] Taint: generalize taint propagation to simplify adding moreAnna Zaks
taint propagation functions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148266 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-14[analyzer] Taint: add system and popen as undesirable sinks for taintAnna Zaks
data. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148176 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-13[analyzer] Taint: when looking up a binding, provide the type.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148080 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-12[analyzer] Rename Store::Retrieve() -> getBinding().Anna Zaks
+ all the other Retrieve..() methods + a comment for ElementRegion. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148011 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-12[analyzer] Add taint transfer by strcpy & others (part 1).Anna Zaks
To simplify the process: Refactor taint generation checker to simplify passing the information on which arguments need to be tainted from pre to post visit. Todo: We need to factor out the code that sema is using to identify the string and memcpy functions and use it here and in the CString checker. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148010 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-11"This change adds alloca/valloc checks to UnixAPIChecker. It includes a ↵Ted Kremenek
small refactoring for the common *alloc functions as well as a few tiny wibbles (adds a note to CWE/CERT advisory numbers in the bug output, and fixes a couple 80-column-wide violations.)" Patch by Austin Seipp! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147931 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-07Remove unused variable.Rafael Espindola
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147744 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-07[analyzer] Add basic format string vulnerability checking.Anna Zaks
We already have a more conservative check in the compiler (if the format string is not a literal, we warn). Still adding it here for completeness and since this check is stronger - only triggered if the format string is tainted. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147714 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-06[analyzer] Make the entries in 'Environment' context-sensitive by making ↵Ted Kremenek
entries map from (Stmt*,LocationContext*) pairs to SVals instead of Stmt* to SVals. This is needed to support basic IPA via inlining. Without this, we cannot tell if a Stmt* binding is part of the current analysis scope (StackFrameContext) or part of a parent context. This change introduces an uglification of the use of getSVal(), and thus takes two steps forward and one step back. There are also potential performance implications of enlarging the Environment. Both can be addressed going forward by refactoring the APIs and optimizing the internal representation of Environment. This patch mainly introduces the functionality upon when we want to build upon (and clean up). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147688 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-04[analyzer] Be less pessimistic about invalidation of global variablesAnna Zaks
as a result of a call. Problem: Global variables, which come in from system libraries should not be invalidated by all calls. Also, non-system globals should not be invalidated by system calls. Solution: The following solution to invalidation of globals seems flexible enough for taint (does not invalidate stdin) and should not lead to too many false positives. We split globals into 3 classes: * immutable - values are preserved by calls (unless the specific global is passed in as a parameter): A : Most system globals and const scalars * invalidated by functions defined in system headers: B: errno * invalidated by all other functions (note, these functions may in turn contain system calls): B: errno C: all other globals (which are not in A nor B) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147569 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-04Fix 80 col violations.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147566 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-04Minor code formatting cleanups.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147505 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-03Enhance UnixAPIChecker to also warn about zero-sized allocations to calloc() ↵Ted Kremenek
and realloc(). Patch by Cyril Roelandt! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147500 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-03Add initial version of checker to check if virtual member functions are ↵Ted Kremenek
called transitively from C++ constructors or destructors. Checker by Lei Zhang with a few tweaks by Ted Kremenek. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147494 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-29Fix cmake build with -DBUILD_SHARED_LIBS=ON.Rafael Espindola
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147338 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-22Colorize and condense CFG pretty-printing.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147203 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-22Fix typos in analyzer diagnostics pointed out by Matt Beaumont-Gay and ↵Ted Kremenek
Robert Purves. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147139 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-17[analyzer] Add support for taint flowing through a function (atoi).Anna Zaks
Check if the input parameters are tainted (or point to tainted data) on a checkPreStmt<CallExpr>. If the output should be tainted, record it in the state. On post visit (checkPostStmt<CallExpr>), use the state to make decisions (in addition to the existing logic). Use this logic for atoi and fscanf. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146793 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-16[analyzer] Better stdin support.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146748 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-14[analyzer] Treat stdin as a source of taint.Anna Zaks
Some of the test cases do not currently work because the analyzer core does not seem to call checkers for pre/post DeclRefExpr visits. (Opened radar://10573500. To be fixed later on.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146536 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-14[analyzer] Mark output of fscanf and fopen as tainted.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146533 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-14[analyzer] Mark getenv output as tainted.Anna Zaks
Also, allow adding taint to a region (not only a symbolic value). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146532 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-11[analyzer] CStringChecker should not rely on the analyzer generating ↵Anna Zaks
UndefOrUnknown value when it cannot reason about the expression. We are now often generating expressions even if the solver is not known to be able to simplify it. This is another cleanup of the existing code, where the rest of the analyzer and checkers should not base their logic on knowing ahead of the time what the solver can reason about. In this case, CStringChecker is performing a check for overflow of 'left+right' operation. The overflow can be checked with either 'maxVal-left' or 'maxVal-right'. Previously, the decision was based on whether the expresion evaluated to undef or not. With this patch, we check if one of the arguments is a constant, in which case we know that 'maxVal-const' is easily simplified. (Another option is to use canReasonAbout() method of the solver here, however, it's currently is protected.) This patch also contains 2 small bug fixes: - swap the order of operators inside SValBuilder::makeGenericVal. - handle a case when AddeVal is unknown in GenericTaintChecker::getPointedToSymbol. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146343 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-08Unbreak MSVC build.Francois Pichet
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146146 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-08Add an experimental MallocSizeofChecker, which reports inconsistenciesPeter Collingbourne
between the casted type of the return value of a malloc/calloc/realloc call and the operand of any sizeof expressions contained within its argument(s). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146144 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-06DeadStoresChecker: when whitelisting dead initializations with constants, lookRichard Smith
for a foldable constant rather than an IR-level constant. This is still far too liberal, but is a step in the right direction. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145990 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-06[analyzer] Refactor: Move symbol_iterator from SVal to SymExpr, use itAnna Zaks
for finding dependent symbols for taint. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145986 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-06[analyzer] Remove an unnecessary check.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145984 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-05[analyzer] Rely on LLVM Dominators in Clang dominator computation.Anna Zaks
(Previously, Clang used it's implementation of dominators.) The patch is contributed by Guoping Long! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145858 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-05[analyzer] Change RetainCountChecker to use symbol dump method insteadAnna Zaks
of relying on SymbolID. This way any expression can be printed (not only SymbolData). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145829 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-05[analyzer] Add a debug checker to test for tainted data.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145827 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-01[analyzer] Make KeychainAPI checker less aggressive. radar://10508828Anna Zaks
We trigger an error if free is called after a possibly failed allocation. Do not trigger the error if we know that the buffer is not null. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145584 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-01[analyzer] Refactor checkers to use helper function for getting callee Decl ↵Anna Zaks
and name. We are getting name of the called function or it's declaration in a few checkers. Refactor them to use the helper function in the CheckerContext. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145576 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-01Further tweak -Wurneachable-code and templates by allowing the warning to run onTed Kremenek
explicit template specializations (which represent actual functions somebody wrote). Along the way, refactor some other code which similarly cares about whether or not they are looking at a template instantiation. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145547 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-30Update CMake build.Benjamin Kramer
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145506 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-30[analyzer] Add checker callback documentation.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@145495 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-18[analyzer] Warn when non pointer arguments are passed to scanf (only when ↵Anna Zaks
running taint checker). There is an open radar to implement better scanf checking as a Sema warning. However, a bit of redundancy is fine in this case. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144964 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-16Update CMake build.Benjamin Kramer
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144829 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-16[analyzer] Catch the first taint propagation implied buffer overflow.Anna Zaks
Change the ArrayBoundCheckerV2 to be more aggressive in reporting buffer overflows when the offset is tainted. Previously, we did not report bugs when the state was underconstrained (not enough information about the bound to determine if there is an overflow) to avoid false positives. However, if we know that the buffer offset is tainted - comes in from the user space and can be anything, we should report it as a bug. + The very first example of us catching a taint related bug. This is the only example we can currently handle. More to come... git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144826 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-16[analyzer] Adding generic taint checker.Anna Zaks
The checker is responsible for defining attack surface and adding taint to symbols. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144825 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-16[analyzer] Factor getCalleeName to the checker context.Anna Zaks
many checkers are trying to get a name of the callee when visiting a CallExpr, so provide a convenience API. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144820 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-14[static analyzer] Tweak RetainCountChecker's diagnostics to correctly ↵Ted Kremenek
indicate if a message was due to a property access. This can potentially be refactored for other clients, and this is a regression from the refactoring of property acceses. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144571 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-10Constant expression evaluation: support for evaluation of structs and unions ofRichard Smith
literal types, as well as derived-to-base casts for lvalues and derived-to-virtual-base casts. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144265 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-08[analyzer] Remove redundant check from DivZeroCheckerAnna Zaks
Analysis by Ted: " if (stateZero && !stateNotZero) { is checking to see if: (A) "it is possible for the value to be zero" (stateZero) AND (B) "it is not possible for the value to be non-zero" (!stateNotZero) That said, the only way for both B to be true AND A to be false is if the path is completely infeasible by the time we reach the divide-by-zero check. For the most part (all cases?), such cases should automatically get pruned out at branches (i.e., an infeasible path gets dropped), which is the case in our tests. So the question is whether or not such an infeasible path might not get dropped earlier? I can't envision any right now. Indeed, the rest of the checker assumes that if the bug condition didn't fire then 'stateNotZero' is non-NULL: C.addTransition(stateNotZero); " git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@144114 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-05[analyzer] There should be a space between "expect" and "only"Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143787 91177308-0d34-0410-b5e6-96231b3b80d8
2011-11-01[analyzer] CheckerContext::getPredecessor() cleanupAnna Zaks
Remove unnecessary calls to CheckerContext::getPredecessor() + Comments. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143513 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-28[analyzer] ObjC message sends to nil receivers that return structs are now ↵Ted Kremenek
okay (compiler zeroes out the data). Fixes <rdar://problem/9151319>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143215 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-26[analyzer] Add getLocationContext to CheckerContextAnna Zaks
CheckerContext::getPredecessor is only used to get to the LocationContext half of the times. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143061 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-26[analyzer] Remove EmitBasicReport form CheckerContext.Anna Zaks
The path sensitive checkers should use EmitBasicReport, which provides the node information. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143060 91177308-0d34-0410-b5e6-96231b3b80d8
2011-10-26[analyzer] Rename generateNode -> addTransition in CheckerContextAnna Zaks
Also document addTransition methods. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@143059 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-07-19 06:50:22 +0000