2009-06-09 05:21:24 +08:00
< !DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
"http://www.w3.org/TR/html4/strict.dtd">
< html >
< head >
< title > Available Checks< / title >
2012-01-15 23:26:07 +08:00
< link type = "text/css" rel = "stylesheet" href = "menu.css" >
< link type = "text/css" rel = "stylesheet" href = "content.css" >
2010-02-13 05:05:44 +08:00
< script type = "text/javascript" src = "scripts/menu.js" > < / script >
2012-01-15 23:26:07 +08:00
< style type = "text/css" >
tr:first-child { width:20%; }
< / style >
2009-06-09 05:21:24 +08:00
< / head >
< body >
2010-02-10 07:05:59 +08:00
< div id = "page" >
2009-06-09 05:21:24 +08:00
<!-- #include virtual="menu.html.incl" -->
< div id = "content" >
< h1 > Available Checks< / h1 >
2011-11-05 13:20:54 +08:00
< h3 > The list of the checks the analyzer performs by default< / h3 >
< p >
< table border = "0" cellpadding = "3" cellspacing = "3" width = "100%" >
<!-- <tr>
< th > < h4 > Checker Name< / h4 > < / th >
< th > < h4 > Description< / h4 > < / th >
< / tr > -->
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > core.AdjustedReturnValue< / b > < / td > < td > Check to see if the return value of a function call is different than the caller expects (e.g., from calls through function pointers).< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > core.CallAndMessage< / b > < / td > < td > Check for logical errors for function calls and Objective-C message expressions (e.g., uninitialized arguments, null function pointers).< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > core.DivideZero< / b > < / td > < td > Check for division by zero.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2013-04-20 06:19:14 +08:00
< td > < b > core.NonNullParamChecker< / b > < / td > < td > Check for null pointers passed as arguments to a function whose arguments are known to be non-null.< / td >
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > core.NullDereference< / b > < / td > < td > Check for dereferences of null pointers.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > core.StackAddressEscape< / b > < / td > < td > Check that addresses to stack memory do not escape the function.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > core.UndefinedBinaryOperatorResult< / b > < / td > < td > Check for undefined results of binary operators.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > core.VLASize< / b > < / td > < td > Check for declarations of VLA of undefined or zero size.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > core.builtin.BuiltinFunctions< / b > < / td > < td > Evaluate compiler builtin functions (e.g., alloca()).< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > core.builtin.NoReturnFunctions< / b > < / td > < td > Evaluate "panic" functions that are known to not return to the caller.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > core.uninitialized.ArraySubscript< / b > < / td > < td > Check for uninitialized values used as array subscripts.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > core.uninitialized.Assign< / b > < / td > < td > Check for assigning uninitialized values.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > core.uninitialized.Branch< / b > < / td > < td > Check for uninitialized values used as branch conditions.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > core.uninitialized.CapturedBlockVariable< / b > < / td > < td > Check for blocks that capture uninitialized values.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > core.uninitialized.UndefReturn< / b > < / td > < td > Check for uninitialized values being returned to the caller.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2013-04-20 06:19:14 +08:00
< td > < b > cplusplus.NewDelete< / b > < / td > < td > Check for double-free and use-after-free problems involving C++ < code > delete< / code > .< / td >
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > deadcode.DeadStores< / b > < / td > < td > Check for values stored to variables that are never read afterwards.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
2012-05-10 01:57:16 +08:00
<!--
2011-11-05 13:20:54 +08:00
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > deadcode.IdempotentOperations< / b > < / td > < td > Warn about idempotent operations.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
2012-05-10 01:57:16 +08:00
-->
2011-11-05 13:20:54 +08:00
< tr >
2013-04-20 06:19:14 +08:00
< td > < b > osx.API< / b > < / td > < td > Check for proper uses of various Apple APIs.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > osx.SecKeychainAPI< / b > < / td > < td > Check for proper uses of Secure Keychain APIs.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2013-04-20 06:19:14 +08:00
< td > < b > osx.cocoa.AtSync< / b > < / td > < td > Check for nil pointers used as mutexes for @synchronized.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > osx.cocoa.ClassRelease< / b > < / td > < td > Check for sending 'retain', 'release', or 'autorelease' directly to a Class.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > osx.cocoa.IncompatibleMethodTypes< / b > < / td > < td > Warn about Objective-C method signatures with type incompatibilities.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > osx.cocoa.NSAutoreleasePool< / b > < / td > < td > Warn for suboptimal uses of NSAutoreleasePool in Objective-C GC mode.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > osx.cocoa.NSError< / b > < / td > < td > Check usage of NSError** parameters.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > osx.cocoa.NilArg< / b > < / td > < td > Check for prohibited nil arguments to ObjC method calls.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > osx.cocoa.RetainCount< / b > < / td > < td > Check for leaks and improper reference count management.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-05-10 01:57:16 +08:00
< td > < b > osx.cocoa.SelfInit< / b > < / td > < td > Check that 'self' is properly initialized inside an initializer method.< / td >
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > osx.cocoa.UnusedIvars< / b > < / td > < td > Warn about private ivars that are never used.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > osx.cocoa.VariadicMethodTypes< / b > < / td > < td > Check for passing non-Objective-C types to variadic methods that expect only Objective-C types.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > osx.coreFoundation.CFError< / b > < / td > < td > Check usage of CFErrorRef* parameters.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > osx.coreFoundation.CFNumber< / b > < / td > < td > Check for proper uses of CFNumberCreate.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
< tr >
2012-11-08 01:12:37 +08:00
< td > < b > osx.coreFoundation.CFRetainRelease< / b > < / td > < td > Check for null arguments to CFRetain/CFRelease/CFMakeCollectable.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
2012-10-07 01:14:39 +08:00
< tr >
2012-05-10 01:57:16 +08:00
< td > < b > osx.coreFoundation.containers.OutOfBounds< / b > < / td > < td > Checks for index out-of-bounds when using 'CFArray' API.< / td >
< / tr >
< tr >
< td > < b > osx.coreFoundation.containers.PointerSizedValues< / b > < / td > < td > Warns if 'CFArray', 'CFDictionary', 'CFSet' are created with non-pointer-size values.< / td >
< / tr >
< tr >
< td > < b > security.FloatLoopCounter< / b > < / td > < td > Warn on using a floating point value as a loop counter (CERT: FLP30-C, FLP30-CPP).< / td >
< / tr >
< tr >
< td > < b > security.insecureAPI.UncheckedReturn< / b > < / td > < td > Warn on uses of functions whose return values must be always checked.< / td >
< / tr >
< tr >
< td > < b > security.insecureAPI.getpw< / b > < / td > < td > Warn on uses of the 'getpw' function.< / td >
< / tr >
< tr >
< td > < b > security.insecureAPI.gets< / b > < / td > < td > Warn on uses of the 'gets' function.< / td >
< / tr >
< tr >
< td > < b > security.insecureAPI.mkstemp< / b > < / td > < td > Warn when 'mkstemp' is passed fewer than 6 X's in the format string.< / td >
< / tr >
< tr >
< td > < b > security.insecureAPI.mktemp< / b > < / td > < td > Warn on uses of the 'mktemp' function.< / td >
< / tr >
< tr >
< td > < b > security.insecureAPI.rand< / b > < / td > < td > Warn on uses of the 'rand', 'random', and related functions.< / td >
< / tr >
< tr >
< td > < b > security.insecureAPI.strcpy< / b > < / td > < td > Warn on uses of the 'strcpy' and 'strcat' functions.< / td >
< / tr >
< tr >
< td > < b > security.insecureAPI.vfork< / b > < / td > < td > Warn on uses of the 'vfork' function.< / td >
< / tr >
2011-11-05 13:20:54 +08:00
< tr >
2012-01-15 23:26:07 +08:00
< td > < b > unix.API< / b > < / td > < td > Check calls to various UNIX/Posix functions.< / td >
2011-11-05 13:20:54 +08:00
< / tr >
2012-05-10 01:57:16 +08:00
< tr >
2013-04-20 06:19:14 +08:00
< td > < b > unix.Malloc< / b > < / td > < td > Check for memory leaks, double free, and use-after-free problems involving < code > malloc< / code > .< / td >
2012-05-10 01:57:16 +08:00
< / tr >
< tr >
< td > < b > unix.MallocSizeof< / b > < / td > < td > Check for dubious malloc arguments involving sizeof.< / td >
< / tr >
< tr >
2013-04-20 06:19:14 +08:00
< td > < b > unix.MismatchedDeallocator< / b > < / td > < td > Check for mismatched deallocators (e.g. passing a pointer allocating with < code > new< / code > to < code > free()< / code > ).< / td >
< / tr >
< tr >
2012-05-10 01:57:16 +08:00
< td > < b > unix.cstring.BadSizeArg< / b > < / td > < td > Check the size argument passed into C string functions for common erroneous patterns.< / td >
< / tr >
< tr >
< td > < b > unix.cstring.NullArg< / b > < / td > < td > Check for null pointers being passed as arguments to C string functions.< / td >
2011-11-05 13:20:54 +08:00
< / table >
2013-01-09 03:29:37 +08:00
< p > In addition to these the analyzer contains numerous experimental (alpha) checkers.< / p >
2011-11-05 13:20:54 +08:00
< h3 > Writeups with examples of some of the bugs that the analyzer finds< / h3 >
2009-06-09 05:21:24 +08:00
< ul >
< li > < a href = "http://www.mobileorchard.com/bug-finding-with-clang-5-resources-to-get-you-started/" > Bug Finding With Clang: 5 Resources To Get You Started< / a > < / li >
< li > < a href = "http://fruitstandsoftware.com/blog/index.php/2008/08/finding-memory-leaks-with-the-llvmclang-static-analyzer/#comment-2" > Finding Memory Leaks With The LLVM/Clang Static Analyzer< / a > < / li >
< li > < a href = "http://www.rogueamoeba.com/utm/2008/07/14/the-clang-static-analyzer/" > Under the Microscope - The Clang Static Analyzer< / a > < / li >
< li > < a href = "http://www.mikeash.com/?page=pyblog/friday-qa-2009-03-06-using-the-clang-static-analyzer.html" > Mike Ash - Using the Clang Static Analyzer< / a > < / li >
< / ul >
2010-02-10 07:05:59 +08:00
< / div >
2009-06-09 05:21:24 +08:00
< / div >
< / body >
< / html >
