aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer/Checkers
AgeCommit message (Collapse)Author
2011-07-15Clean up UnixAPIChecker, including switching its array of BugTypes to ↵Jordy Rose
llvm::OwningPtr<BugType> vars (the new convention). No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135255 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-15Clean up MacOSXAPIChecker, including switching its array of BugTypes to a ↵Jordy Rose
single llvm::OwningPtr<BugType> (the new convention). No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@135250 91177308-0d34-0410-b5e6-96231b3b80d8
2011-07-02Update for llvm commit r134291.Eric Christopher
Fixes rdar://9714064 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@134292 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-21Introduce a new AST node describing reference binding to temporaries.Douglas Gregor
MaterializeTemporaryExpr captures a reference binding to a temporary value, making explicit that the temporary value (a prvalue) needs to be materialized into memory so that its address can be used. The intended AST invariant here is that a reference will always bind to a glvalue, and MaterializeTemporaryExpr will be used to convert prvalues into glvalues for that binding to happen. For example, given const int& r = 1.0; The initializer of "r" will be a MaterializeTemporaryExpr whose subexpression is an implicit conversion from the double literal "1.0" to an integer value. IR generation benefits most from this new node, since it was previously guessing (badly) when to materialize temporaries for the purposes of reference binding. There are likely more refactoring and cleanups we could perform there, but the introduction of MaterializeTemporaryExpr fixes PR9565, a case where IR generation would effectively bind a const reference directly to a bitfield in a struct. Addresses <rdar://problem/9552231>. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@133521 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-20[analyzer] Finish size argument checking for strncat (and strncpy).Jordy Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@133472 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-20[analyzer] Replace stream-built error message with constant string. No ↵Jordy Rose
functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@133410 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-20[analyzer] Re-enable checking for strncpy, along with a new validation of ↵Jordy Rose
the size argument. strncat is not yet up-to-date, but I'm leaving it enabled for now (there shouldn't be any false positives, at least...) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@133408 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-20[analyzer] Eliminate "byte string function" from CStringChecker's ↵Jordy Rose
diagnostics, and make it easier to provide custom messages for overflow checking, in preparation for re-enabling strncpy checking. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@133406 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-16[analyzer] Clean up modeling of strcmp, including cases where a string ↵Jordy Rose
literal has an embedded null character, and where both arguments are the same buffer. Also use nested ifs rather than early returns; in this case early returns will lose any assumptions we've made earlier in the function. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@133154 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-16[analyzer] Fix trivial errors in previous commit.Jordy Rose
I will not commit without building first. I will not commit without building first. I will not commit without building first... git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@133150 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-16[analyzer] Cleanup: mainly 80-char violations and preferring ↵Jordy Rose
SValBuilder::getComparisonType() to just referencing IntTy. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@133149 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-15Automatic Reference Counting.John McCall
Language-design credit goes to a lot of people, but I particularly want to single out Blaine Garst and Patrick Beard for their contributions. Compiler implementation credit goes to Argyrios, Doug, Fariborz, and myself, in no particular order. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@133103 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-15[analyzer] Revise CStringChecker's modelling of strcpy() and strcat():Jordy Rose
- (bounded copies) Be more conservative about how much is being copied. - (str(n)cat) If we can't compute the exact final length of an append operation, we can still lower-bound it. - (stpcpy) Fix the conjured return value at the end to actually be returned. This requires these supporting changes: - C string metadata symbols are still live even when buried in a SymExpr. - "Hypothetical" C string lengths, to represent a value that /will/ be passed to setCStringLength() if all goes well. (The idea is to allow for temporary constrainable symbols that may end up becoming permanent.) - The 'checkAdditionOverflow' helper makes sure that the two strings being appended in a strcat don't overflow size_t. This should never *actually* happen; the real effect is to keep the final string length from "wrapping around" in the constraint manager. This doesn't actually test the "bounded" operations (strncpy and strncat) because they can leave strings unterminated. Next on the list! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@133046 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-15[analyzer] If a C string length is UnknownVal, clear any existing length ↵Jordy Rose
binding. No tests yet because the only thing that sets string length is strcpy(), and that needs some work anyway. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@133044 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-14[analyzer] CStringChecker checks functions in the C standard library, not ↵Jordy Rose
C++. Its external name is now unix.experimental.CString. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@132958 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-14[analyzer] Change large if body to early return. No functionality change.Jordy Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@132956 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-14[analyzer] Fix modeling of strnlen to be more conservative. Move tests we ↵Jordy Rose
can't properly model (yet?) to string-fail.c. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@132955 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-04[analyzer] Change an indent-if to an early return. No functionality change.Jordy Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@132618 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-04[analyzer] Don't crash when copying an unknown number of bytes with ↵Jordy Rose
memcpy(). Also handle all memcpy-family return values in evalCopyCommon(), rather than having some outside and some inside. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@132617 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-04[analyzer] Remove extra assignment that actually lost a few of the assumptions.Jordy Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@132614 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-04[analyzer] Fix comment for (still-disabled) evalStrncpyJordy Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@132608 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-04[analyzer] Fix handling of "copy zero bytes" for memcpy and friends.Jordy Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@132607 91177308-0d34-0410-b5e6-96231b3b80d8
2011-06-03[analyzer] __mempcpy_chk is the same as mempcpy (at least to CStringChecker)Jordy Rose
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@132605 91177308-0d34-0410-b5e6-96231b3b80d8
2011-05-06Modify some deleted function methods to better reflect reality:Sean Hunt
- New isDefined() function checks for deletedness - isThisDeclarationADefinition checks for deletedness - New doesThisDeclarationHaveABody() does what isThisDeclarationADefinition() used to do - The IsDeleted bit is not propagated across redeclarations - isDeleted() now checks the canoncial declaration - New isDeletedAsWritten() does what it says on the tin. - isUserProvided() now correct (thanks Richard!) This fixes the bug that we weren't catching void foo() = delete; void foo() {} as being a redefinition. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@131013 91177308-0d34-0410-b5e6-96231b3b80d8
2011-05-03Removing strncpy() checking in CString checker for now. Some significant ↵Lenny Maiorani
changes need to be made to properly support modeling of it since it potentially leaves strings non-null terminated. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@130758 91177308-0d34-0410-b5e6-96231b3b80d8
2011-05-02Augment retain/release checker to not warn about tracked objects passed as ↵Ted Kremenek
arguments to C++ constructors. This is a stop-gap measure for Objective-C++ code that uses smart pointers to manage reference counts. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@130711 91177308-0d34-0410-b5e6-96231b3b80d8
2011-05-02Implements strncasecmp() checker and simplifies some of the logic around ↵Lenny Maiorani
creating substrings if necessary and calling the appropriate StringRef::compare/compare_lower(). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@130708 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-30Move the SelfInit checker to the 'cocoa.experimental' package.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@130598 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-28Use StringRef::substr() and unbounded StringRef::compare() instead of ↵Lenny Maiorani
bounded version of StringRef::compare() because bounded version of StringRef::compare() is going to be removed. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@130425 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-28Eliminates an assert in the strncpy/strncat checker caused by not validating ↵Lenny Maiorani
a cast was successful. If the value of an argument was unknown, the cast would result in a NULL pointer which was later being dereferenced. This fixes Bugzilla #9806. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@130422 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-28Implements strcasecmp() checker in Static Analyzer.Lenny Maiorani
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@130398 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-27More accurately model realloc() when the size argument is 0. realloc() with ↵Lenny Maiorani
a size of 0 is equivalent to free(). The memory region should be marked as free and not used again. Unit tests f2_realloc_0(), f6_realloc(), and f7_realloc() contributed by Marshall Clow <mclow.lists@gmail.com>. Thanks! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@130303 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-27Allow 'Environment::getSVal()' to allow an optional way for checkers to do a ↵Ted Kremenek
direct lookup to values bound to expressions, without resulting to lazy logic. This is critical for the OSAtomicChecker that does a simulated load on any arbitrary expression. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@130292 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-25Implements the strncmp() checker just like the strcmp() checker, but with ↵Lenny Maiorani
bounds. Requires LLVM svn r129582. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@130161 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-23Remove unused STL header includes.Jay Foad
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@130068 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-19Make the VariadicMethodTypeChecker accept block pointers as Objective-C ↵Anders Carlsson
pointers. Fixes PR9746. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@129741 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-15Support for C++11 (non-template) alias declarations.Richard Smith
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@129567 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-15fix a bunch of comment typos found by codespell. Patch byChris Lattner
Luis Felipe Strano Moraes! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@129559 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-12Teach VariadicMethodTypeChecker to not crash when processing methods ↵Ted Kremenek
declared in protocols. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@129395 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-12Fix another IdempotentOperationsChecker corner case when determining if an ↵Ted Kremenek
active block on the worklist impacts the results of the check. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@129394 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-12ArrayBoundCheckerV2: don't arbitrarily warn about indexing before the ↵Ted Kremenek
0-index of a symbolic region. In many cases that isn't really the base offset. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@129366 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-12This patch adds modeling of strcmp() to the CString checker. Validates ↵Lenny Maiorani
inputs are not NULL and are real C strings, then does the comparison and binds the proper return value. Unit tests included. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@129364 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-09strcat() and strncat() model additions to CStringChecker.Lenny Maiorani
Validates inputs are not NULL, checks for overlapping strings, concatenates the strings checking for buffer overflow, sets the length of the destination string to the sum of the s1 length and the s2 length, binds the return value to the s1 value. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@129215 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-05Add security syntax checker for strcat() which causes the Static Analyzer to ↵Lenny Maiorani
generate a warning any time the strcat() function is used with a note suggesting to use a function which provides bounded buffers. CWE-119. Also, brings the security syntax checker more inline with coding standards. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128916 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-03Refactoring the security checker a little bit so that each CallExpr check ↵Lenny Maiorani
doesn't get called for each CallExpr. Instead it does a switch and only runs the check for the proper identifier. Slight speed improvement (probably significant on very large ASTs), and should make it easier and more clear to add more checks for other CallExpr's later. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128785 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-02Remove a redundant method. We have a const version.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128762 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-02Teach IdempotentOperationsChecker about paths aborted because ExprEngine ↵Ted Kremenek
didn't know how to handle a specific Expr type. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128761 91177308-0d34-0410-b5e6-96231b3b80d8
2011-04-02static analyzer: Rename 'BlocksAborted' to 'BlocksExhausted' to reflect that ↵Ted Kremenek
a given CFGBlock was analyzed too many times. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128760 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-31Add security syntax checker for strcpy() which causes the Static Analyzer to ↵Lenny Maiorani
generate a warning any time the strcpy() function is used with a note suggesting to use a function which provides bounded buffers. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128679 91177308-0d34-0410-b5e6-96231b3b80d8
2011-03-31Adding Static Analyzer checker for mempcpy().Lenny Maiorani
Models mempcpy() so that if length is NULL the destination pointer is returned. Otherwise, the source and destination are confirmed not to be NULL and not overlapping. Finally the copy is validated to not cause a buffer overrun and the return value is bound to the address of the byte after the last byte copied. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128677 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-07-23 03:04:29 +0000