Commit Graph

36 Commits

Author SHA1 Message Date
Ted Kremenek ee9848e20d Fix regression in -Wuninitialized involving VLAs. It turns out that we were modeling sizeof(VLAs)
incorrectly in the CFG, and also the static analyzer.  This patch regresses the analyzer a bit, but
that needs to be followed up with a better solution.

Fixes <rdar://problem/10008112>.

llvm-svn: 138372
2011-08-23 20:30:50 +00:00
Ted Kremenek 7765dda06a [analyzer] add more buffer overflow tests to show we handle sizeof(VLA) in obstruse ways...
llvm-svn: 137007
2011-08-06 00:34:48 +00:00
Ted Kremenek 3f955e6d89 [analyzer] rename all experimental checker packages to have 'experimental' be the common root package.
llvm-svn: 136835
2011-08-03 23:14:55 +00:00
Ted Kremenek 49c79790de Rework checker "packages" and groups to be more hierarchical.
llvm-svn: 128187
2011-03-24 00:28:47 +00:00
Argyrios Kyrtzidis 9eb02dfa89 [analyzer] Remove '-analyzer-check-objc-mem' flag, the nominee for best misnomer award.
llvm-svn: 126676
2011-02-28 19:49:42 +00:00
Argyrios Kyrtzidis f3ed8b631d [analyzer] Migrate BuiltinFunctionChecker to CheckerV2.
llvm-svn: 126611
2011-02-28 01:27:07 +00:00
Argyrios Kyrtzidis 21c9423ef4 [analyzer] Remove '-analyzer-experimental-checks' flag.
llvm-svn: 126607
2011-02-28 01:26:43 +00:00
Argyrios Kyrtzidis b388f77ad9 [analyzer] Remove '-analyzer-experimental-internal-checks' flag, it doesn't have any checkers associated with it anymore.
llvm-svn: 126440
2011-02-24 21:43:08 +00:00
Argyrios Kyrtzidis dd407f423b [analyzer] Migrate ArrayBoundChecker to CheckerV2.
llvm-svn: 126371
2011-02-24 08:42:12 +00:00
Chandler Carruth 1af88f12a3 Enhance the array bounds checking to work for several other constructs,
especially C++ code, and generally expand the test coverage.

Logic adapted from a patch by Kaelyn Uhrain <rikka@google.com> and
another Googler.

llvm-svn: 125775
2011-02-17 21:10:52 +00:00
Jordy Rose df28e8ec41 - Allow making ElementRegions with complex offsets (expressions or symbols) for the purpose of bounds-checking.
- Rewrite GRState::AssumeInBound to actually do that checking, and to use the normal constraint path.
- Remove ConstraintManager::AssumeInBound.
- Teach RegionStore and FlatStore to ignore those regions for now.

llvm-svn: 111116
2010-08-16 01:15:17 +00:00
Jordy Rose a797475712 Add a test for alloca region extents.
llvm-svn: 111079
2010-08-14 20:46:10 +00:00
Jordy Rose 0704a7fe43 Support sizeof for VLA expressions (sizeof(someVLA)). sizeof(int[n]) still unimplemented. A VLA region's sizeof value matches its extent.
llvm-svn: 107611
2010-07-05 04:42:43 +00:00
Jordy Rose e6b999bf9a Track extents for VLAs.
llvm-svn: 107603
2010-07-05 00:50:15 +00:00
Jordy Rose 674bd55f02 Add a new symbol type, SymbolExtent, to represent the extents of memory regions that may not be known at compile-time (such as those created by malloc). This replaces the old setExtent/getExtent API on Store, which used the GRState's GDM to store SVals.
Also adds a getKnownValue() method to SValuator, which gets the integer value of an SVal if it is known to only have one possible value. There are more places in the code that could be using this, but in general we want to be dealing entirely in SVals, so its usefulness is limited.

The only visible functionality change is that extents are now honored for any DeclRegion, such as fields and Objective-C ivars, rather than just variables. This shows up in bounds-checking and cast-size-checking.

llvm-svn: 107577
2010-07-04 00:00:41 +00:00
Jordy Rose c3bcc36a0b When a constant size array is casted to another type, its length should be scaled as well.
llvm-svn: 106911
2010-06-25 23:23:04 +00:00
Zhongxing Xu 527ff6d1dc Add support for calloc() in MallocChecker. Patch by Jordy Rose, with my
modification.

llvm-svn: 105264
2010-06-01 03:01:33 +00:00
Zhongxing Xu 640aad7667 Use the element type to compute the array size when the base region is a VarRegion.
Patch by Jordy Rose.

llvm-svn: 100099
2010-04-01 08:20:27 +00:00
Ted Kremenek 2f2692f8ca Rename -cc1 option '-checker-cfref' to '-analyzer-check-objc-mem'.
llvm-svn: 95348
2010-02-05 02:06:54 +00:00
Zhongxing Xu 228b0d4def Add support for computing size in elements for symbolic regions obtained from
malloc().

llvm-svn: 93722
2010-01-18 08:54:31 +00:00
Daniel Dunbar 8fbe78f6fc Update tests to use %clang_cc1 instead of 'clang-cc' or 'clang -cc1'.
- This is designed to make it obvious that %clang_cc1 is a "test variable"
   which is substituted. It is '%clang_cc1' instead of '%clang -cc1' because it
   can be useful to redefine what gets run as 'clang -cc1' (for example, to set
   a default target).

llvm-svn: 91446
2009-12-15 20:14:24 +00:00
Zhongxing Xu 27f686f8ec Replace clang-cc with clang -cc1.
llvm-svn: 91272
2009-12-14 06:34:20 +00:00
Ted Kremenek 4ef13f8ac9 Add clang-cc option "--analyzer-experimental-internal-checks". This
option enables new "internal" checks that will eventually be turned on
by default but still require broader testing.

llvm-svn: 88671
2009-11-13 18:46:29 +00:00
Zhongxing Xu 4f7759a339 Reimplement out-of-bound array access checker with the new checker interface.
Now only one test case is XFAIL'ed.

llvm-svn: 86834
2009-11-11 12:33:27 +00:00
Daniel Dunbar a530841b4f Switch XFAIL format to match LLVM.
llvm-svn: 85880
2009-11-03 07:25:45 +00:00
Ted Kremenek eb01ba670e Temporarily disable out-of-bounds checking. The current checking logic will not work quite right with the changes I'm about to commit.
llvm-svn: 77779
2009-08-01 05:59:39 +00:00
Ted Kremenek 1642bdaaa5 Introduce a new concept to the static analyzer: SValuator.
GRTransferFuncs had the conflated role of both constructing SVals (symbolic
expressions) as well as handling checker-specific logic. Now SValuator has the
role of constructing SVals from expressions and GRTransferFuncs just handles
checker-specific logic. The motivation is by separating these two concepts we
will be able to much more easily create richer constraint-generating logic
without coupling it to the main checker transfer function logic.

We now have one implementation of SValuator: SimpleSValuator.

SimpleSValuator is essentially the SVal-related logic that was in GRSimpleVals
(which is removed in this patch). This includes the logic for EvalBinOp,
EvalCast, etc. Because SValuator has a narrower role than the old
GRTransferFuncs, the interfaces are much simpler, and so is the implementation
of SimpleSValuator compared to GRSimpleVals. I also did a line-by-line review of
SVal-related logic in GRSimpleVals and cleaned it up while moving it over to
SimpleSValuator.

As a consequence of removing GRSimpleVals, there is no longer a
'-checker-simple' option. The '-checker-cfref' did everything that option did
but also ran the retain/release checker. Of course a user may not always wish to
run the retain/release checker, nor do we wish core analysis logic buried in the
checker-specific logic. The next step is to refactor the logic in CFRefCount.cpp
to separate out these pieces into the core analysis engine.

llvm-svn: 74229
2009-06-26 00:05:51 +00:00
Daniel Dunbar a45cf5b6b0 Rename clang to clang-cc.
Tests and drivers updated, still need to shuffle dirs.

llvm-svn: 67602
2009-03-24 02:24:46 +00:00
Ted Kremenek b535181199 Static Analyzer driver/options (partial) cleanup:
- Move all analyzer options logic to AnalysisConsumer.cpp.
- Unified specification of stores/constraints/output to be:
   -analyzer-output=...
   -analyzer-store=...
   -analyzer-constraints=...
  instead of -analyzer-range-constraints, -analyzer-store-basic, etc.
- Updated drivers (ccc-analyzer, scan-builds, new ccc) to obey this new
  interface
- Updated test cases to conform to new driver options

llvm-svn: 64737
2009-02-17 04:27:41 +00:00
Ted Kremenek e54b87f477 Test more array logic in outofbound.c
llvm-svn: 62782
2009-01-22 20:36:33 +00:00
Ted Kremenek 92d48a71f5 Fix RegionStore::getLValueElement() to handle the case when the base region is not an ElementRegion (also do some cleanups of its core logic).
This gets array-struct.c to work with RegionStore.

llvm-svn: 62781
2009-01-22 20:27:48 +00:00
Daniel Dunbar 34fc92fdc2 Add -analyze action to run static analyzer, instead of inferring from
individual checker options.

llvm-svn: 62634
2009-01-20 23:17:32 +00:00
Ted Kremenek 75c4d57b9c This test now passes.
llvm-svn: 62132
2009-01-13 01:06:56 +00:00
Ted Kremenek 1c89be0216 Temporarily XFAIL these tests.
llvm-svn: 60991
2008-12-13 19:27:01 +00:00
Zhongxing Xu f556cd6cb9 Strings are NULL terminated. So the region size should plus one.
llvm-svn: 59943
2008-11-24 05:16:01 +00:00
Zhongxing Xu bf900755d0 Add test case for out-of-bound memory access checking.
llvm-svn: 59931
2008-11-24 02:19:49 +00:00