177ecfac21
KeychainAPI checker: Track SymbolMetadata instead of MemRegion in checker state so that we could clear the state on evalDeadSymbols; also track the return value.
...
llvm-svn: 137003
2011-08-05 23:52:45 +00:00
c52bed1814
KeychainAPI checker: Generate an error on double allocation. Pull out getAsPointeeMemoryRegion so that it could be reused.
...
llvm-svn: 136952
2011-08-05 00:37:00 +00:00
c686177555
KeychainAPI checker: Track additional pair of SecKeychain APIs. Also, keep exploring the transition on which a call to allocator function failed (to be able to find errors in examples like ErrorCodesFromDifferentAPISDoNotInterfere).
...
llvm-svn: 136930
2011-08-04 21:53:01 +00:00
08be9b99e3
KeychainAPI checker: Refactor to make it easier to add more allocator/deallocator API pairs. Add the allocator function ID to the checker state. Better comments.
...
llvm-svn: 136889
2011-08-04 17:28:06 +00:00
4aa34a5325
KeychainAPI checker: refactor to use early exit.
...
llvm-svn: 136852
2011-08-04 00:31:38 +00:00
388c18ec7f
KeychainAPI checker: Add basic diagnostics. Track MemoryRegion istead of SymbolicRef since the address might not be a symbolic value in some cases, for example in fooOnlyFree() test.
...
llvm-svn: 136851
2011-08-04 00:26:57 +00:00
907377e303
[analyzer] Remove 'all-experimental' checker group.
...
llvm-svn: 136849
2011-08-04 00:25:50 +00:00
3f955e6d89
[analyzer] rename all experimental checker packages to have 'experimental' be the common root package.
...
llvm-svn: 136835
2011-08-03 23:14:55 +00:00
1c2fb270ce
[analyzer] Introduce MallocOverflowSecurityChecker, a simple flow-sensitive checker that may be useful for security auditing. This checker is currently too noisy to be on by default.
...
llvm-svn: 136804
2011-08-03 20:17:43 +00:00
9ab728bb05
KeychainAPI checker: only check the paths on which the allocator function returned noErr. (+ minor cleanup)
...
llvm-svn: 136694
2011-08-02 17:11:03 +00:00
15f496c118
Add a skeleton for the Keychain Services API Checker. Register it as OSX experimental for now. Note, the checker still does not handle tracking of escaped values, taking into account the return value of the allocator functions, nor the actual bug reporting..
...
llvm-svn: 136659
2011-08-01 22:40:01 +00:00
558e37858b
Remove dead code flagged by GCC's -Wunused-but-set-variable.
...
llvm-svn: 136581
2011-07-31 01:06:41 +00:00
e9fda1e48a
[analyzer] Overhaul how the static analyzer expects CFGs by forcing CFGs to be linearized only when used by the static analyzer. This required a rewrite of LiveVariables, and exposed a ton of subtle bugs.
...
The motivation of this large change is to drastically simplify the logic in ExprEngine going forward.
Some fallout is that the output of some BugReporterVisitors is not as accurate as before; those will
need to be fixed over time. There is also some possible performance regression as RemoveDeadBindings
will be called frequently; this can also be improved over time.
llvm-svn: 136419
2011-07-28 23:07:59 +00:00
e227f49302
[analyzer] fix bug in malloc checker where the tracked symbol would not properly be removed from the state.
...
llvm-svn: 136418
2011-07-28 23:07:51 +00:00
d48db2115a
Rename getInstantiationLineNumber to getExpansionLineNumber in both
...
SourceManager and FullSourceLoc.
llvm-svn: 135969
2011-07-25 21:09:52 +00:00
0e62c1cc0b
remove unneeded llvm:: namespace qualifiers on some core types now that LLVM.h imports
...
them into the clang namespace.
llvm-svn: 135852
2011-07-23 10:55:15 +00:00
a39e10fd7c
[analyzer] Very minor cleanup in PthreadLockChecker. No functionality change.
...
llvm-svn: 135518
2011-07-19 20:31:42 +00:00
d9c522100e
[analysis] Add checks for double-locking and lock order reversal bugs for
...
pthread and XNU locks. Patch by Rui Paulo!
llvm-svn: 135515
2011-07-19 20:21:41 +00:00
c85964ed90
[analyzer] Place checking for Core Foundation "Create" rule into a proper API. No functionality change.
...
llvm-svn: 135349
2011-07-16 19:50:32 +00:00
f3dd00a26c
Clean up UnixAPIChecker, including switching its array of BugTypes to llvm::OwningPtr<BugType> vars (the new convention). No functionality change.
...
llvm-svn: 135255
2011-07-15 06:28:59 +00:00
ede26958bf
Clean up MacOSXAPIChecker, including switching its array of BugTypes to a single llvm::OwningPtr<BugType> (the new convention). No functionality change.
...
llvm-svn: 135250
2011-07-15 06:02:19 +00:00
bf15d2b311
Update for llvm commit r134291.
...
Fixes rdar://9714064
llvm-svn: 134292
2011-07-02 00:20:22 +00:00
fe31481f68
Introduce a new AST node describing reference binding to temporaries.
...
MaterializeTemporaryExpr captures a reference binding to a temporary
value, making explicit that the temporary value (a prvalue) needs to
be materialized into memory so that its address can be used. The
intended AST invariant here is that a reference will always bind to a
glvalue, and MaterializeTemporaryExpr will be used to convert prvalues
into glvalues for that binding to happen. For example, given
const int& r = 1.0;
The initializer of "r" will be a MaterializeTemporaryExpr whose
subexpression is an implicit conversion from the double literal "1.0"
to an integer value.
IR generation benefits most from this new node, since it was
previously guessing (badly) when to materialize temporaries for the
purposes of reference binding. There are likely more refactoring and
cleanups we could perform there, but the introduction of
MaterializeTemporaryExpr fixes PR9565, a case where IR generation
would effectively bind a const reference directly to a bitfield in a
struct. Addresses <rdar://problem/9552231>.
llvm-svn: 133521
2011-06-21 17:03:29 +00:00
b41f7c55f5
[analyzer] Finish size argument checking for strncat (and strncpy).
...
llvm-svn: 133472
2011-06-20 21:55:40 +00:00
789adbb3ed
[analyzer] Replace stream-built error message with constant string. No functionality change.
...
llvm-svn: 133410
2011-06-20 03:51:53 +00:00
328deeed7f
[analyzer] Re-enable checking for strncpy, along with a new validation of the size argument. strncat is not yet up-to-date, but I'm leaving it enabled for now (there shouldn't be any false positives, at least...)
...
llvm-svn: 133408
2011-06-20 03:49:16 +00:00
dceb0cf3f3
[analyzer] Eliminate "byte string function" from CStringChecker's diagnostics, and make it easier to provide custom messages for overflow checking, in preparation for re-enabling strncpy checking.
...
llvm-svn: 133406
2011-06-20 02:06:40 +00:00
c026370858
[analyzer] Clean up modeling of strcmp, including cases where a string literal has an embedded null character, and where both arguments are the same buffer. Also use nested ifs rather than early returns; in this case early returns will lose any assumptions we've made earlier in the function.
...
llvm-svn: 133154
2011-06-16 07:13:34 +00:00
0585a61821
[analyzer] Fix trivial errors in previous commit.
...
I will not commit without building first.
I will not commit without building first.
I will not commit without building first...
llvm-svn: 133150
2011-06-16 05:56:50 +00:00
455bd58d4e
[analyzer] Cleanup: mainly 80-char violations and preferring SValBuilder::getComparisonType() to just referencing IntTy.
...
llvm-svn: 133149
2011-06-16 05:51:02 +00:00
31168b077c
Automatic Reference Counting.
...
Language-design credit goes to a lot of people, but I particularly want
to single out Blaine Garst and Patrick Beard for their contributions.
Compiler implementation credit goes to Argyrios, Doug, Fariborz, and myself,
in no particular order.
llvm-svn: 133103
2011-06-15 23:02:42 +00:00
634c12d23f
[analyzer] Revise CStringChecker's modelling of strcpy() and strcat():
...
- (bounded copies) Be more conservative about how much is being copied.
- (str(n)cat) If we can't compute the exact final length of an append operation, we can still lower-bound it.
- (stpcpy) Fix the conjured return value at the end to actually be returned.
This requires these supporting changes:
- C string metadata symbols are still live even when buried in a SymExpr.
- "Hypothetical" C string lengths, to represent a value that /will/ be passed to setCStringLength() if all goes well. (The idea is to allow for temporary constrainable symbols that may end up becoming permanent.)
- The 'checkAdditionOverflow' helper makes sure that the two strings being appended in a strcat don't overflow size_t. This should never *actually* happen; the real effect is to keep the final string length from "wrapping around" in the constraint manager.
This doesn't actually test the "bounded" operations (strncpy and strncat) because they can leave strings unterminated. Next on the list!
llvm-svn: 133046
2011-06-15 05:52:56 +00:00
0e9fb28e95
[analyzer] If a C string length is UnknownVal, clear any existing length binding. No tests yet because the only thing that sets string length is strcpy(), and that needs some work anyway.
...
llvm-svn: 133044
2011-06-15 05:14:03 +00:00
bc7483f505
[analyzer] CStringChecker checks functions in the C standard library, not C++. Its external name is now unix.experimental.CString.
...
llvm-svn: 132958
2011-06-14 01:40:43 +00:00
45d8c12b68
[analyzer] Change large if body to early return. No functionality change.
...
llvm-svn: 132956
2011-06-14 01:26:48 +00:00
d359289669
[analyzer] Fix modeling of strnlen to be more conservative. Move tests we can't properly model (yet?) to string-fail.c.
...
llvm-svn: 132955
2011-06-14 01:15:31 +00:00
fb5e8c2814
[analyzer] Change an indent-if to an early return. No functionality change.
...
llvm-svn: 132618
2011-06-04 01:50:25 +00:00
097c5397a8
[analyzer] Don't crash when copying an unknown number of bytes with memcpy(). Also handle all memcpy-family return values in evalCopyCommon(), rather than having some outside and some inside.
...
llvm-svn: 132617
2011-06-04 01:47:27 +00:00
64ae92e5c5
[analyzer] Remove extra assignment that actually lost a few of the assumptions.
...
llvm-svn: 132614
2011-06-04 01:22:21 +00:00
4451cd4511
[analyzer] Fix comment for (still-disabled) evalStrncpy
...
llvm-svn: 132608
2011-06-04 00:05:23 +00:00
63b84be6cb
[analyzer] Fix handling of "copy zero bytes" for memcpy and friends.
...
llvm-svn: 132607
2011-06-04 00:04:22 +00:00
aee7fb9e64
[analyzer] __mempcpy_chk is the same as mempcpy (at least to CStringChecker)
...
llvm-svn: 132605
2011-06-03 23:42:56 +00:00
4a8ea1092a
Modify some deleted function methods to better reflect reality:
...
- New isDefined() function checks for deletedness
- isThisDeclarationADefinition checks for deletedness
- New doesThisDeclarationHaveABody() does what
isThisDeclarationADefinition() used to do
- The IsDeleted bit is not propagated across redeclarations
- isDeleted() now checks the canoncial declaration
- New isDeletedAsWritten() does what it says on the tin.
- isUserProvided() now correct (thanks Richard!)
This fixes the bug that we weren't catching
void foo() = delete;
void foo() {}
as being a redefinition.
llvm-svn: 131013
2011-05-06 20:44:56 +00:00
5066858bcd
Removing strncpy() checking in CString checker for now. Some significant changes need to be made to properly support modeling of it since it potentially leaves strings non-null terminated.
...
llvm-svn: 130758
2011-05-03 16:34:26 +00:00
aa181174e7
Augment retain/release checker to not warn about tracked objects passed as arguments to C++ constructors. This is a stop-gap measure for Objective-C++ code that uses smart pointers to manage reference counts.
...
llvm-svn: 130711
2011-05-02 19:42:42 +00:00
0b510279c6
Implements strncasecmp() checker and simplifies some of the logic around creating substrings if necessary and calling the appropriate StringRef::compare/compare_lower().
...
llvm-svn: 130708
2011-05-02 19:05:49 +00:00
8067746554
Move the SelfInit checker to the 'cocoa.experimental' package.
...
llvm-svn: 130598
2011-04-30 06:46:45 +00:00
18470e3287
Use StringRef::substr() and unbounded StringRef::compare() instead of bounded version of StringRef::compare() because bounded version of StringRef::compare() is going to be removed.
...
llvm-svn: 130425
2011-04-28 19:31:12 +00:00
ed2cc6ccbb
Eliminates an assert in the strncpy/strncat checker caused by not validating a cast was successful. If the value of an argument was unknown, the cast would result in a NULL pointer which was later being dereferenced.
...
This fixes Bugzilla #9806 .
llvm-svn: 130422
2011-04-28 18:59:43 +00:00
4af23c8159
Implements strcasecmp() checker in Static Analyzer.
...
llvm-svn: 130398
2011-04-28 15:09:11 +00:00
Anna Zaks