aboutsummaryrefslogtreecommitdiff
path: root/lib/StaticAnalyzer
AgeCommit message (Collapse)Author
2012-01-16Refactor variables unused under non-assert builds.David Blaikie
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148229 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-14[analyzer] Taint: add system and popen as undesirable sinks for taintAnna Zaks
data. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148176 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-13[analyzer] Unwrap the pointers when ignoring the const cast.Anna Zaks
radar://10686991 git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148081 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-13[analyzer] Taint: when looking up a binding, provide the type.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148080 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-13[analyzer] RegionStoreManager::getBinding() should not crash whenAnna Zaks
looking up value at a CodeTextRegion even when the type is not provided. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148079 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-13[analyzer] Fix a typo in a warning message.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148078 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-12[analyzer] fix inlining's handling of mapping actual to formal arguments and ↵Ted Kremenek
limit the call stack depth. The analyzer can now accurately simulate factorial for limited depths. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148036 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-12[analyzer] Rename Store::Retrieve() -> getBinding().Anna Zaks
+ all the other Retrieve..() methods + a comment for ElementRegion. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148011 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-12[analyzer] Add taint transfer by strcpy & others (part 1).Anna Zaks
To simplify the process: Refactor taint generation checker to simplify passing the information on which arguments need to be tainted from pre to post visit. Todo: We need to factor out the code that sema is using to identify the string and memcpy functions and use it here and in the CString checker. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148010 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-11"This change adds alloca/valloc checks to UnixAPIChecker. It includes a ↵Ted Kremenek
small refactoring for the common *alloc functions as well as a few tiny wibbles (adds a note to CWE/CERT advisory numbers in the bug output, and fixes a couple 80-column-wide violations.)" Patch by Austin Seipp! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147931 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-11Remove '#if 0' from ExprEngine::InlineCall(), and start fresh by wiring up ↵Ted Kremenek
inlining for straight C calls. My hope is to reimplement this from first principles based on the simplifications of removing unneeded node builders and re-evaluating how C++ calls are handled in the CFG. The hope is to turn inlining "on-by-default" as soon as possible with a core set of things working well, and then expand over time. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147904 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-10Make PathDiagnosticLocation more resilient to null Stmt pointers.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147854 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-07Remove unused variable.Rafael Espindola
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147744 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-07[analyzer] Fix use-after-free in HandleTranslationUnit.Anna Zaks
A patch by Dmitri Gribenko! The attached patch fixes a use-after-free in AnalysisConsumer::HandleTranslationUnit. The problem is that BugReporter's destructor runs after AnalysisManager has been already deleted. The fix introduces a scope to force correct destruction order. A crash happens only when reports have been added in AnalysisConsumer::HandleTranslationUnit's BugReporter. We don't have such checkers in clang so no test. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147732 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-07[analyzer] Add basic format string vulnerability checking.Anna Zaks
We already have a more conservative check in the compiler (if the format string is not a literal, we warn). Still adding it here for completeness and since this check is stronger - only triggered if the format string is tainted. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147714 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-07[analyzer] Remove CallEnterNodeBuilder and simplify ↵Ted Kremenek
ExprEngine::processCallEnter(). This removes analysis of other translation units, but that was an experimental feature anyway that we will revisit later. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147705 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-07Correctly enqueue successors in ExprEngine::processCallExit().Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147698 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-07[analyzer] Remove CallExitNodeBuilder, and have ↵Ted Kremenek
ExprEngine::processCallExit() do the work manually. This is a nice simplification. Along the way, fix Exprengine::processCallExit() to also perform the postStmt callback for checkers for CallExprs. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147697 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-06[analyzer] Make the entries in 'Environment' context-sensitive by making ↵Ted Kremenek
entries map from (Stmt*,LocationContext*) pairs to SVals instead of Stmt* to SVals. This is needed to support basic IPA via inlining. Without this, we cannot tell if a Stmt* binding is part of the current analysis scope (StackFrameContext) or part of a parent context. This change introduces an uglification of the use of getSVal(), and thus takes two steps forward and one step back. There are also potential performance implications of enlarging the Environment. Both can be addressed going forward by refactoring the APIs and optimizing the internal representation of Environment. This patch mainly introduces the functionality upon when we want to build upon (and clean up). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147688 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-04[analyzer] Be less pessimistic about invalidation of global variablesAnna Zaks
as a result of a call. Problem: Global variables, which come in from system libraries should not be invalidated by all calls. Also, non-system globals should not be invalidated by system calls. Solution: The following solution to invalidation of globals seems flexible enough for taint (does not invalidate stdin) and should not lead to too many false positives. We split globals into 3 classes: * immutable - values are preserved by calls (unless the specific global is passed in as a parameter): A : Most system globals and const scalars * invalidated by functions defined in system headers: B: errno * invalidated by all other functions (note, these functions may in turn contain system calls): B: errno C: all other globals (which are not in A nor B) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147569 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-04Fix 80 col violations.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147566 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-04Extend ConditionBRVisitor to handle condition variable assignments.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147526 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-04Minor code formatting cleanups.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147505 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-03Enhance UnixAPIChecker to also warn about zero-sized allocations to calloc() ↵Ted Kremenek
and realloc(). Patch by Cyril Roelandt! git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147500 91177308-0d34-0410-b5e6-96231b3b80d8
2012-01-03Add initial version of checker to check if virtual member functions are ↵Ted Kremenek
called transitively from C++ constructors or destructors. Checker by Lei Zhang with a few tweaks by Ted Kremenek. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147494 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-29Fix cmake build with -DBUILD_SHARED_LIBS=ON.Rafael Espindola
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147338 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-28Small refactoring and simplification of constant evaluation and some of itsRichard Smith
clients. No functionality change. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147318 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-22Colorize and condense CFG pretty-printing.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147203 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-22Fix typos in analyzer diagnostics pointed out by Matt Beaumont-Gay and ↵Ted Kremenek
Robert Purves. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147139 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-20[analyzer] Do not invalidate arguments when the parameter'sAnna Zaks
type is a pointer to const. (radar://10595327) The regions corresponding to the pointer and reference arguments to a function get invalidated by the calls since a function call can possibly modify the pointed to data. With this change, we are not going to invalidate the data if the argument is a pointer to const. This change makes the analyzer more optimistic in reporting errors. (Support for C, C++ and Obj C) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@147002 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-20Fix inversion of static analyzer path diagnostics for path conditions.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146993 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-20Update the CMake build for r146959's new files.Chandler Carruth
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146967 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-20Unweaken vtables as per ↵David Blaikie
http://llvm.org/docs/CodingStandards.html#ll_virtual_anch git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146959 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-17[analyzer] Add support for taint flowing through a function (atoi).Anna Zaks
Check if the input parameters are tainted (or point to tainted data) on a checkPreStmt<CallExpr>. If the output should be tainted, record it in the state. On post visit (checkPostStmt<CallExpr>), use the state to make decisions (in addition to the existing logic). Use this logic for atoi and fscanf. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146793 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-17[analyzer] Minor: Simplify & assert.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146792 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-16[analyzer] Better stdin support.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146748 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-15[analyzer] Address Jordy's comments for r145985.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146683 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-15[analyzer] Ensure that the order in which checker callbacks are calledAnna Zaks
is deterministic. Non-determinism was the reason for the test which caused the earlier buildbot failures, so re-enable the test. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146628 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-14[analyzer] Treat stdin as a source of taint.Anna Zaks
Some of the test cases do not currently work because the analyzer core does not seem to call checkers for pre/post DeclRefExpr visits. (Opened radar://10573500. To be fixed later on.) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146536 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-14[analyzer] Minor refactor to addTaint.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146535 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-14[analyzer] Mark output of fscanf and fopen as tainted.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146533 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-14[analyzer] Mark getenv output as tainted.Anna Zaks
Also, allow adding taint to a region (not only a symbolic value). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146532 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-11[analyzer] CStringChecker should not rely on the analyzer generating ↵Anna Zaks
UndefOrUnknown value when it cannot reason about the expression. We are now often generating expressions even if the solver is not known to be able to simplify it. This is another cleanup of the existing code, where the rest of the analyzer and checkers should not base their logic on knowing ahead of the time what the solver can reason about. In this case, CStringChecker is performing a check for overflow of 'left+right' operation. The overflow can be checked with either 'maxVal-left' or 'maxVal-right'. Previously, the decision was based on whether the expresion evaluated to undef or not. With this patch, we check if one of the arguments is a constant, in which case we know that 'maxVal-const' is easily simplified. (Another option is to use canReasonAbout() method of the solver here, however, it's currently is protected.) This patch also contains 2 small bug fixes: - swap the order of operators inside SValBuilder::makeGenericVal. - handle a case when AddeVal is unknown in GenericTaintChecker::getPointedToSymbol. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146343 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-10[analyzer]Fixup r146336.Anna Zaks
Forgot to commit the Header files. Rename generateUnknownVal -> makeGenericVal. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146337 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-10[analyzer] Introduce IntSymExpr, where the integer is on the lhs.Anna Zaks
Fix a bug in SimpleSValBuilder, where we should swap lhs and rhs when calling generateUnknownVal(), - the function which creates symbolic expressions when data is tainted. The issue is not visible when we only create the expressions for taint since all expressions are commutative from taint perspective. Refactor SymExpr::symbol_iterator::expand() to use a switch instead of a chain of ifs. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146336 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-09[analyzer] Fix inconsistency on when SValBuilder assumes that 2Anna Zaks
types are equivalent. + A taint test which tests bitwise operations and which was triggering an assertion due to presence of the integer to integer cast. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146240 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-08[analyzer] If memory region is tainted mark data as tainted.Anna Zaks
+ random comments git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146199 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-08Unbreak MSVC build.Francois Pichet
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146146 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-08Add an experimental MallocSizeofChecker, which reports inconsistenciesPeter Collingbourne
between the casted type of the return value of a malloc/calloc/realloc call and the operand of any sizeof expressions contained within its argument(s). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146144 91177308-0d34-0410-b5e6-96231b3b80d8
2011-12-07[analyzer] Cleanup: use the variable.Anna Zaks
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@146056 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-07-19 20:36:58 +0000