Commit Graph

71 Commits

Author SHA1 Message Date
Anna Zaks b3b56bb960 [analyzer] CString Checker: Do not split the path unless the user
specifically checks for equality to null.

Enforcing this general practice, which keeps the analyzer less
noisy, in the CString Checker. This change suppresses "Assigned value is
garbage or undefined" warning in the added test case.

llvm-svn: 156085
2012-05-03 18:21:28 +00:00
Anna Zaks b508d29b78 [analyzer] Don't crash even when the system functions are redefined.
(Applied changes to CStringAPI, Malloc, and Taint.)

This might almost never happen, but we should not crash even if it does.
This fixes a crash on the internal analyzer buildbot, where postgresql's
configure was redefining memmove (radar://11219852).

llvm-svn: 154451
2012-04-10 23:41:11 +00:00
Ted Kremenek 1e809b4c4c [analyzer] Implement basic path diagnostic pruning based on "interesting" symbols and regions.
Essentially, a bug centers around a story for various symbols and regions.  We should only include
the path diagnostic events that relate to those symbols and regions.

The pruning is done by associating a set of interesting symbols and regions with a BugReporter, which
can be modified at BugReport creation or by BugReporterVisitors.

This patch reduces the diagnostics emitted in several of our test cases.  I've vetted these as
having desired behavior.  The only regression is a missing null check diagnostic for the return
value of realloc() in test/Analysis/malloc-plist.c.  This will require some investigation to fix,
and I have added a FIXME to the test case.

llvm-svn: 152361
2012-03-09 01:13:14 +00:00
Ted Kremenek d519cae8aa Have conjured symbols depend on LocationContext, to add context sensitivity for functions called more than once.
llvm-svn: 150849
2012-02-17 23:13:45 +00:00
Anna Zaks e56167e8f8 [analyzer] Fix another false positive in the Malloc Checker, by making
it aware of CString APIs that return the input parameter.

Malloc Checker needs to know how the 'strcpy' function is
evaluated. Introduce the dependency on CStringChecker for that.
CStringChecker knows all about these APIs.

Addresses radar://10864450

llvm-svn: 150846
2012-02-17 22:35:31 +00:00
Anna Zaks 6348a810fe [analyzer] Generalize function name checking in CString checker.
(Ex: It was not treating __inline_strcpy as strcpy. Will add tests that
rely on this later on.)

llvm-svn: 150845
2012-02-17 22:35:26 +00:00
Anna Zaks 3d34834bb0 [analyzer] Make Malloc Checker optimistic in presence of inlining.
(In response of Ted's review of r150112.)

This moves the logic which checked if a symbol escapes through a
parameter to invalidateRegionCallback (instead of post CallExpr visit.)

To accommodate the change, added a CallOrObjCMessage parameter to
checkRegionChanges callback.

llvm-svn: 150513
2012-02-14 21:55:24 +00:00
Anna Zaks e0c7c27473 [analyzer] Allow each CString check to be enabled/disabled
separately.

llvm-svn: 149947
2012-02-07 00:56:14 +00:00
Dylan Noblesmith 2c1dd2716a Basic: import SmallString<> into clang namespace
(I was going to fix the TODO about DenseMap too, but
that would break self-host right now. See PR11922.)

llvm-svn: 149799
2012-02-05 02:13:05 +00:00
Dylan Noblesmith e27789991d Basic: import OwningPtr<> into clang namespace
llvm-svn: 149798
2012-02-05 02:12:40 +00:00
Benjamin Kramer 4903802fbf Move a method from IdentifierTable.h out of line and remove the SmallString include.
Fix all the transitive include users.

llvm-svn: 149783
2012-02-04 13:45:25 +00:00
Benjamin Kramer 3307c508c9 Move various diagnostic operator<< overloads out of line and remove includes of Diagnostic.h.
Fix all the files that depended on transitive includes of Diagnostic.h.
With this patch in place changing a diagnostic no longer requires a full rebuild of the StaticAnalyzer.

llvm-svn: 149781
2012-02-04 12:31:12 +00:00
Ted Kremenek 49b1e38e4b Change references to 'const ProgramState *' to typedef 'ProgramStateRef'.
At this point this is largely cosmetic, but it opens the door to replace
ProgramStateRef with a smart pointer that more eagerly acts in the role
of reclaiming unused ProgramState objects.

llvm-svn: 149081
2012-01-26 21:29:00 +00:00
Ted Kremenek 632e3b7ee2 [analyzer] Make the entries in 'Environment' context-sensitive by making entries map from
(Stmt*,LocationContext*) pairs to SVals instead of Stmt* to SVals.

This is needed to support basic IPA via inlining.  Without this, we cannot tell
if a Stmt* binding is part of the current analysis scope (StackFrameContext) or
part of a parent context.

This change introduces an uglification of the use of getSVal(), and thus takes
two steps forward and one step back.  There are also potential performance implications
of enlarging the Environment.  Both can be addressed going forward by refactoring the
APIs and optimizing the internal representation of Environment.  This patch
mainly introduces the functionality upon when we want to build upon (and clean up).

llvm-svn: 147688
2012-01-06 22:09:28 +00:00
Anna Zaks 7c96b7db96 [analyzer] CStringChecker should not rely on the analyzer generating UndefOrUnknown value when it cannot reason about the expression.
We are now often generating expressions even if the solver is not known to be able to simplify it. This is another cleanup of the existing code, where the rest of the analyzer and checkers should not base their logic on knowing ahead of the time what the solver can reason about. 

In this case, CStringChecker is performing a check for overflow of 'left+right' operation. The overflow can be checked with either 'maxVal-left' or 'maxVal-right'. Previously, the decision was based on whether the expresion evaluated to undef or not. With this patch, we check if one of the arguments is a constant, in which case we know that 'maxVal-const' is easily simplified. (Another option is to use canReasonAbout() method of the solver here, however, it's currently is protected.)

This patch also contains 2 small bug fixes:
 - swap the order of operators inside SValBuilder::makeGenericVal.
 - handle a case when AddeVal is unknown in GenericTaintChecker::getPointedToSymbol.

llvm-svn: 146343
2011-12-11 18:43:40 +00:00
Anna Zaks ee1a43533b [analyzer] Refactor: Move symbol_iterator from SVal to SymExpr, use it
for finding dependent symbols for taint.

llvm-svn: 145986
2011-12-06 23:12:33 +00:00
Anna Zaks c6aa531a8f [analyzer] Refactor checkers to use helper function for getting callee Decl and name.
We are getting name of the called function or it's declaration in a few checkers. Refactor them to use the helper function in the CheckerContext. 

llvm-svn: 145576
2011-12-01 05:57:37 +00:00
Anna Zaks c9abbe2b3e [analyzer] Add getLocationContext to CheckerContext
CheckerContext::getPredecessor is only used to get to the LocationContext
half of the times.

llvm-svn: 143061
2011-10-26 21:06:44 +00:00
Anna Zaks da4c8d6811 [analyzer] Rename generateNode -> addTransition in CheckerContext
Also document addTransition methods.

llvm-svn: 143059
2011-10-26 21:06:34 +00:00
Anna Zaks b473816b4a [analyzer] Simplify CheckerContext
Remove dead members/parameters: ProgramState, respondsToCallback, autoTransition.
Remove addTransition method since it's the same as generateNode. Maybe we should
rename generateNode to genTransition (since a transition is always automatically
generated)?

llvm-svn: 142946
2011-10-25 19:57:06 +00:00
Benjamin Kramer b89514a9b8 Change operator<< for raw_ostream and NamedDecl to take a reference instead of a pointer.
Passing a pointer was a bad idea as it collides with the overload for void*.

llvm-svn: 141971
2011-10-14 18:45:37 +00:00
Anna Zaks cc92521066 [analyzer] Fix a typo.
llvm-svn: 141678
2011-10-11 16:49:54 +00:00
Anna Zaks 23d7ba3579 [analyzer] Removing references to CheckerContext::getNodeBuilder(): checkers can obtain block count directly from the Context.
llvm-svn: 141112
2011-10-04 20:43:05 +00:00
Jordy Rose 1fad663126 [analyzer] Change the check::RegionChanges callback to include the regions explicitly requested for invalidation.
Also, allow CallOrObjCMessage to wrap a CXXConstructExpr as well.

Finally, this allows us to remove the clunky whitelisting system from CFRefCount/RetainReleaseChecker. Slight regression due to CXXNewExprs not yet being handled in post-statement callbacks (PR forthcoming).

llvm-svn: 138716
2011-08-27 22:51:26 +00:00
Anna Zaks f86615ca5c Static Analyzer Diagnostics: Kill the addVisitorCreator(callbackTy, void*) API in favor of addVisitor(BugReporterVisitor*).
1) Create a header file to expose the predefined visitors. And move the parent(BugReporterVisitor) there as well.

2) Remove the registerXXXVisitor functions - the Visitor constructors/getters can be used now to create the object. One exception is registerVarDeclsLastStore(), which registers more then one visitor, so make it static member of FindLastStoreBRVisitor.

3) Modify all the checkers to use the new API.

llvm-svn: 138126
2011-08-19 22:33:38 +00:00
Anna Zaks 3a6bdf8f82 Remove EnhancedBugReport and RangedBugReport - pull all the extra functionality they provided into their parent BugReport. The only functional changes are: made getRanges() non const - it adds default range to Ranges if none are supplied, made getStmt() private, which was another FIXME.
llvm-svn: 137894
2011-08-17 23:00:25 +00:00
Ted Kremenek 001fd5b498 Rename GRState to ProgramState, and cleanup some code formatting along the way.
llvm-svn: 137665
2011-08-15 22:09:50 +00:00
Ted Kremenek 5ef32dbf2a Cleanup various declarations of 'Stmt*' to be 'Stmt *', etc. in libAnalyzer and libStaticAnalyzer[*]. It was highly inconsistent, and very ugly to look at.
llvm-svn: 137537
2011-08-12 23:37:29 +00:00
Jordy Rose add45b78dd [analyzer] Nitpicks on Olaf's patch, which I meant to e-mail but then didn't in
time. One is cleanup, the other is me being OCD about enum group nesting.

llvm-svn: 137517
2011-08-12 21:41:07 +00:00
Ted Kremenek 8df44b2632 [analyzer] Introduce new MemRegion, "TypedValueRegion", so that we can separate TypedRegions that implement getValueType() from those that don't.
Patch by Olaf Krzikalla!

llvm-svn: 137498
2011-08-12 20:02:48 +00:00
Chris Lattner 0e62c1cc0b remove unneeded llvm:: namespace qualifiers on some core types now that LLVM.h imports
them into the clang namespace.

llvm-svn: 135852
2011-07-23 10:55:15 +00:00
Jordy Rose b41f7c55f5 [analyzer] Finish size argument checking for strncat (and strncpy).
llvm-svn: 133472
2011-06-20 21:55:40 +00:00
Jordy Rose 789adbb3ed [analyzer] Replace stream-built error message with constant string. No functionality change.
llvm-svn: 133410
2011-06-20 03:51:53 +00:00
Jordy Rose 328deeed7f [analyzer] Re-enable checking for strncpy, along with a new validation of the size argument. strncat is not yet up-to-date, but I'm leaving it enabled for now (there shouldn't be any false positives, at least...)
llvm-svn: 133408
2011-06-20 03:49:16 +00:00
Jordy Rose dceb0cf3f3 [analyzer] Eliminate "byte string function" from CStringChecker's diagnostics, and make it easier to provide custom messages for overflow checking, in preparation for re-enabling strncpy checking.
llvm-svn: 133406
2011-06-20 02:06:40 +00:00
Jordy Rose c026370858 [analyzer] Clean up modeling of strcmp, including cases where a string literal has an embedded null character, and where both arguments are the same buffer. Also use nested ifs rather than early returns; in this case early returns will lose any assumptions we've made earlier in the function.
llvm-svn: 133154
2011-06-16 07:13:34 +00:00
Jordy Rose 0585a61821 [analyzer] Fix trivial errors in previous commit.
I will not commit without building first.
I will not commit without building first.
I will not commit without building first...

llvm-svn: 133150
2011-06-16 05:56:50 +00:00
Jordy Rose 455bd58d4e [analyzer] Cleanup: mainly 80-char violations and preferring SValBuilder::getComparisonType() to just referencing IntTy.
llvm-svn: 133149
2011-06-16 05:51:02 +00:00
Jordy Rose 634c12d23f [analyzer] Revise CStringChecker's modelling of strcpy() and strcat():
- (bounded copies) Be more conservative about how much is being copied.
- (str(n)cat) If we can't compute the exact final length of an append operation, we can still lower-bound it.
- (stpcpy) Fix the conjured return value at the end to actually be returned.

This requires these supporting changes:
- C string metadata symbols are still live even when buried in a SymExpr.
- "Hypothetical" C string lengths, to represent a value that /will/ be passed to setCStringLength() if all goes well. (The idea is to allow for temporary constrainable symbols that may end up becoming permanent.)
- The 'checkAdditionOverflow' helper makes sure that the two strings being appended in a strcat don't overflow size_t. This should never *actually* happen; the real effect is to keep the final string length from "wrapping around" in the constraint manager.

This doesn't actually test the "bounded" operations (strncpy and strncat) because they can leave strings unterminated. Next on the list!

llvm-svn: 133046
2011-06-15 05:52:56 +00:00
Jordy Rose 0e9fb28e95 [analyzer] If a C string length is UnknownVal, clear any existing length binding. No tests yet because the only thing that sets string length is strcpy(), and that needs some work anyway.
llvm-svn: 133044
2011-06-15 05:14:03 +00:00
Jordy Rose 45d8c12b68 [analyzer] Change large if body to early return. No functionality change.
llvm-svn: 132956
2011-06-14 01:26:48 +00:00
Jordy Rose d359289669 [analyzer] Fix modeling of strnlen to be more conservative. Move tests we can't properly model (yet?) to string-fail.c.
llvm-svn: 132955
2011-06-14 01:15:31 +00:00
Jordy Rose fb5e8c2814 [analyzer] Change an indent-if to an early return. No functionality change.
llvm-svn: 132618
2011-06-04 01:50:25 +00:00
Jordy Rose 097c5397a8 [analyzer] Don't crash when copying an unknown number of bytes with memcpy(). Also handle all memcpy-family return values in evalCopyCommon(), rather than having some outside and some inside.
llvm-svn: 132617
2011-06-04 01:47:27 +00:00
Jordy Rose 64ae92e5c5 [analyzer] Remove extra assignment that actually lost a few of the assumptions.
llvm-svn: 132614
2011-06-04 01:22:21 +00:00
Jordy Rose 4451cd4511 [analyzer] Fix comment for (still-disabled) evalStrncpy
llvm-svn: 132608
2011-06-04 00:05:23 +00:00
Jordy Rose 63b84be6cb [analyzer] Fix handling of "copy zero bytes" for memcpy and friends.
llvm-svn: 132607
2011-06-04 00:04:22 +00:00
Jordy Rose aee7fb9e64 [analyzer] __mempcpy_chk is the same as mempcpy (at least to CStringChecker)
llvm-svn: 132605
2011-06-03 23:42:56 +00:00
Lenny Maiorani 5066858bcd Removing strncpy() checking in CString checker for now. Some significant changes need to be made to properly support modeling of it since it potentially leaves strings non-null terminated.
llvm-svn: 130758
2011-05-03 16:34:26 +00:00
Ted Kremenek aa181174e7 Augment retain/release checker to not warn about tracked objects passed as arguments to C++ constructors. This is a stop-gap measure for Objective-C++ code that uses smart pointers to manage reference counts.
llvm-svn: 130711
2011-05-02 19:42:42 +00:00