467dbd5f13
strcat() and strncat() model additions to CStringChecker.
...
Validates inputs are not NULL, checks for overlapping strings, concatenates the strings checking for buffer overflow, sets the length of the destination string to the sum of the s1 length and the s2 length, binds the return value to the s1 value.
llvm-svn: 129215
2011-04-09 15:12:58 +00:00
f603f3afbd
Start overhauling static analyzer support for C++ constructors. The inlining support isn't complete, and needs
...
to be reworked to model CallEnter/CallExit (just like all other calls). For now, treat constructors mostly
like other function calls, making the analysis of C++ code just a little more useful.
llvm-svn: 129166
2011-04-08 22:42:35 +00:00
3337ca5f95
When updating the retain summary based on {cf,ns}_consumed attributes,
...
be sure to consume the argument index that actually had the attribute
rather than always the first. rdar://problem/9234108
llvm-svn: 128998
2011-04-06 09:02:12 +00:00
de909e4946
Add security syntax checker for strcat() which causes the Static Analyzer to generate a warning any time the strcat() function is used with a note suggesting to use a function which provides bounded buffers. CWE-119.
...
Also, brings the security syntax checker more inline with coding standards.
llvm-svn: 128916
2011-04-05 20:18:46 +00:00
378819342e
Fix PR 9626 (duplicated self-init warnings under -Wuninitialized) with numerous CFG and UninitializedValues analysis changes:
...
1) Change the CFG to include the DeclStmt for conditional variables, instead of using the condition itself as a faux DeclStmt.
2) Update ExprEngine (the static analyzer) to understand (1), so not to regress.
3) Update UninitializedValues.cpp to initialize all tracked variables to Uninitialized at the start of the function/method.
4) Only use the SelfReferenceChecker (SemaDecl.cpp) on global variables, leaving the dataflow analysis to handle other cases.
The combination of (1) and (3) allows the dataflow-based -Wuninitialized to find self-init problems when the initializer
contained control-flow.
llvm-svn: 128858
2011-04-04 23:29:12 +00:00
3657c006cc
Change test/Analysis/idempotent-operations.c to output the .plist file in the test output directory.
...
llvm-svn: 128849
2011-04-04 22:30:01 +00:00
850d35be16
Fix RegionStore bug when doing a field load whose parent is also a field assigned a LazyCompoundValue. Fixes <rdar://problem/9163742> and PR 9522.
...
llvm-svn: 128783
2011-04-03 04:09:15 +00:00
8f89f7c893
Teach IdempotentOperationsChecker about paths aborted because ExprEngine didn't know how to handle a specific Expr type.
...
llvm-svn: 128761
2011-04-02 02:56:23 +00:00
6ffe738f24
Add security syntax checker for strcpy() which causes the Static Analyzer to generate a warning any time the strcpy() function is used with a note suggesting to use a function which provides bounded buffers.
...
llvm-svn: 128679
2011-03-31 22:09:14 +00:00
79d74141b1
Adding Static Analyzer checker for mempcpy().
...
Models mempcpy() so that if length is NULL the destination pointer is returned. Otherwise, the source and destination are confirmed not to be NULL and not overlapping. Finally the copy is validated to not cause a buffer overrun and the return value is bound to the address of the byte after the last byte copied.
llvm-svn: 128677
2011-03-31 21:36:53 +00:00
40d16c0e75
Static analyzer: fix bug in handling of dynamic_cast<>. The sink node wouldn't always be the final node, thus causing the state to continue propagating. Instead,
...
recover some path-sensitivity by conjuring a symbol.
llvm-svn: 128612
2011-03-31 04:46:53 +00:00
61a4f6682a
Teach static analyzer about the basics of handling new[]. We still don't simulate constructors, but at least the analyzer doesn't think the return value is uninitialized.
...
llvm-svn: 128611
2011-03-31 04:04:48 +00:00
98a24e37c5
Begin reworking static analyzer support for C++ method calls. The current logic was divorced
...
from how we process ordinary function calls, had a tremendous about of redundancy, and relied
strictly on inlining behavior (which was incomplete) to provide semantics instead of falling
back to the conservative analysis we use for C functions. This is a significant step into
making C++ analyzer support more useful.
llvm-svn: 128557
2011-03-30 17:41:19 +00:00
642b03413f
Don't add a symbolic region for 'this' if the member function is static.
...
llvm-svn: 128340
2011-03-26 14:30:44 +00:00
49c79790de
Rework checker "packages" and groups to be more hierarchical.
...
llvm-svn: 128187
2011-03-24 00:28:47 +00:00
70727343cf
Teach VariadicMethodTypeChecker about pointers attributed as 'NSObject'.
...
llvm-svn: 127798
2011-03-17 04:10:25 +00:00
6fa1daede5
Teach VariadicMethodTypeChecker that CF references are valid arguments to variadic Objective-C methods.
...
llvm-svn: 127797
2011-03-17 04:01:35 +00:00
3e5ad5932e
Tweak RegionStore's handling of lazy compound values to use the 'Default' versus 'Direct' binding key, thus allowing specific elements of an array/struct to be overwritten without
...
invalidating the entire binding. Fixes PR 9455.
llvm-svn: 127796
2011-03-17 03:51:51 +00:00
4ceebbf54d
VariadicMethodTypeChecker: don't warn for null pointer constants passed to variadic Objective-C methods.
...
llvm-svn: 127719
2011-03-16 00:22:51 +00:00
cdb2ae587a
Remove bogus assertion in IdempotentOperationsChecker.
...
llvm-svn: 127687
2011-03-15 19:27:57 +00:00
792798549f
Remove old UninitializedValues analysis.
...
llvm-svn: 127656
2011-03-15 03:17:01 +00:00
066b226daa
Tweak VariadicMethodTypeChecker to only create one ExplodedNode when issuing multiple warnings for the same message expression.
...
Also add a test case showing that we correctly report multiple warnings for the same message expression.
llvm-svn: 127605
2011-03-14 19:50:37 +00:00
d91d5f162f
Add an Objective-C checker that checks that arguments passed to some variadic Objective-C methods are of Objective-C pointer types.
...
Ted or Argiris, I'd appreciate a review!
llvm-svn: 127572
2011-03-13 20:35:21 +00:00
53e6538fa8
Fix CFG assertion failure reported in PR 9467. This was due to recent changes in optimizing CFGs for switch statements.
...
llvm-svn: 127563
2011-03-13 03:48:04 +00:00
609e814a4a
XFAIL this on windows where <vector> contains surprises.
...
llvm-svn: 127559
2011-03-13 00:55:43 +00:00
cd628393bb
Tweak test to hopefully appease FreeBSD buildbot.
...
llvm-svn: 127533
2011-03-12 08:19:43 +00:00
9997656600
Remove stray output file.
...
llvm-svn: 127532
2011-03-12 06:15:01 +00:00
a4a57c10da
Re-enable the IdempotentOperations checker for --analyze, and put it and the DeadStores checker into the "deadcode" group.
...
llvm-svn: 127531
2011-03-12 06:14:28 +00:00
f89710b936
Add initial version of "IteratorsChecker", a checker to find misues uses of C++ iterators.
...
This checker was created by Jim Goodnow II, and I migrated it to the
new Checker interface (recent changes by Argiris).
llvm-svn: 127525
2011-03-12 02:49:15 +00:00
4bb6c6b37e
static analyzer: Fix use-after-free bug in RegionStore involving LazyCompoundValueData not reference counting Store objects.
...
llvm-svn: 127288
2011-03-08 23:18:00 +00:00
3c50aea73f
Make the Objective-C checker look for subclasses of NSString instead of just NSString and NSMutableString.
...
llvm-svn: 127268
2011-03-08 20:05:26 +00:00
58d489fc6e
Fix tests to account for new warning "expected ';' at end of declaration list". Sorry, folks!
...
llvm-svn: 127188
2011-03-07 22:57:45 +00:00
eff9a7ff91
Teach CFGBuilder to prune trivially unreachable case statements.
...
llvm-svn: 126797
2011-03-01 23:12:55 +00:00
9eb02dfa89
[analyzer] Remove '-analyzer-check-objc-mem' flag, the nominee for best misnomer award.
...
llvm-svn: 126676
2011-02-28 19:49:42 +00:00
af181bb19b
Move test/SemaObjC/method-arg-decay.m -> test/Analysis/method-arg-decay.m
...
llvm-svn: 126675
2011-02-28 19:49:21 +00:00
6a1c760760
[analyzer] Run the ExprEngine depending on the CheckerManager having path-sensitive checkers.
...
llvm-svn: 126674
2011-02-28 19:49:17 +00:00
20f5caa518
[analyzer] The current UninitializedValuesChecker will go away, remove '-warn-uninit-values'.
...
llvm-svn: 126673
2011-02-28 19:49:12 +00:00
2c49ec7f1d
[analyzer] Migrate NSErrorChecker and DereferenceChecker to CheckerV2.
...
They cooperate in that NSErrorChecker listens for ImplicitNullDerefEvent events that
DereferenceChecker can dispatch.
ImplicitNullDerefEvent is when we dereferenced a location that may be null.
llvm-svn: 126659
2011-02-28 17:36:18 +00:00
6d6801c5c7
[analzyer] Migrate CallAndMessageChecker to CheckerV2.
...
llvm-svn: 126626
2011-02-28 01:28:13 +00:00
6fff2e3d36
[analyzer] Migrate AttrNonNullChecker to CheckerV2.
...
llvm-svn: 126623
2011-02-28 01:28:01 +00:00
4dc7fb37cb
[analyzer] Migrate ReturnUndefChecker to CheckerV2.
...
llvm-svn: 126619
2011-02-28 01:27:46 +00:00
098874a2f8
[analyzer] Migrate UndefinedAssignmentChecker to CheckerV2.
...
llvm-svn: 126617
2011-02-28 01:27:37 +00:00
753b3ca32f
[analyzer] Migrate UndefBranchChecker to CheckerV2.
...
llvm-svn: 126616
2011-02-28 01:27:33 +00:00
60b6da721f
[analyzer] Migrate UndefCapturedBlockVarChecker to CheckerV2.
...
llvm-svn: 126615
2011-02-28 01:27:26 +00:00
d4d3cee6e4
[analyzer] Migrate UndefResultChecker to CheckerV2.
...
llvm-svn: 126614
2011-02-28 01:27:22 +00:00
142dbbfcd8
[analyzer] Migrate NoReturnFunctionChecker to CheckerV2.
...
llvm-svn: 126613
2011-02-28 01:27:17 +00:00
3e7ab19863
[analyzer] Move the DeadStores checker out of the 'core' package.
...
-Now it gets enabled with '-analyzer-checker=DeadStores'.
-The driver passes the above flag by default.
llvm-svn: 126612
2011-02-28 01:27:12 +00:00
f3ed8b631d
[analyzer] Migrate BuiltinFunctionChecker to CheckerV2.
...
llvm-svn: 126611
2011-02-28 01:27:07 +00:00
b2cf708395
[analyzer] Migrate OSAtomicChecker to CheckerV2.
...
llvm-svn: 126610
2011-02-28 01:27:02 +00:00
0a9ce3ec8f
[analyzer] Migrate ArrayBoundCheckerV2 to CheckerV2.
...
Turns -analyzer-check-buffer-overflows into -analyzer-checker=core.experimental.Overflow
llvm-svn: 126609
2011-02-28 01:26:57 +00:00
Lenny Maiorani