Commit Graph

24 Commits

Author SHA1 Message Date
Ed Schouten e5bdc8516e Enable security checks for arc4random() on CloudABI as well.
CloudABI also supports the arc4random() function. We can enable compiler
warnings for rand(), random() and *rand48() on this system as well.

llvm-svn: 231914
2015-03-11 08:48:55 +00:00
Reid Kleckner 7f62b95480 Check the canonical parameter type with getAs<>() in a static checker
This will prevent breakage when I introduce the DecayedType sugar node.

llvm-svn: 184755
2013-06-24 16:56:16 +00:00
Ted Kremenek 9bf9af92a4 Allow multiple PathDiagnosticConsumers to be used with a BugReporter at the same time.
This fixes several issues:

- removes egregious hack where PlistDiagnosticConsumer would forward to HTMLDiagnosticConsumer,
but diagnostics wouldn't be generated consistently in the same way if PlistDiagnosticConsumer
was used by itself.

- emitting diagnostics to the terminal (using clang's diagnostic machinery) is no longer a special
case, just another PathDiagnosticConsumer.  This also magically resolved some duplicate warnings,
as we now use PathDiagnosticConsumer's diagnostic pruning, which has scope for the entire translation
unit, not just the scope of a BugReporter (which is limited to a particular ExprEngine).

As an interesting side-effect, diagnostics emitted to the terminal also have their trailing "." stripped,
just like with diagnostics emitted to plists and HTML.  This required some tests to be updated, but now
the tests have higher fidelity with what users will see.

There are some inefficiencies in this patch.  We currently generate the report graph (from the ExplodedGraph)
once per PathDiagnosticConsumer, which is a bit wasteful, but that could be pulled up higher in the
logic stack.  There is some intended duplication, however, as we now generate different PathDiagnostics (for the same issue)
for different PathDiagnosticConsumers.  This is necessary to produce the diagnostics that a particular
consumer expects.

llvm-svn: 162028
2012-08-16 17:45:23 +00:00
Anna Zaks ee5e8ae845 [analyzer] Change the warning to suggest 'strlcat/strlcpy' as
replacements for 'starcat/strcpy' instead of 'strncat/strncpy'.

llvm-svn: 149406
2012-01-31 19:33:31 +00:00
Ted Kremenek 89eaf8d531 Implement checker that looks for calls to mktemps and friends that have fewer than 6 Xs. Implements <rdar://problem/6336672>.
llvm-svn: 148531
2012-01-20 05:35:06 +00:00
Ted Kremenek c54dc9515d Turn 'SecuritySyntaxChecker' into a "meta" security checker for insecure APIs. Now
multiple checks are exposed as separate checkers, but CheckerManager only creates
one Checker object.

llvm-svn: 148525
2012-01-20 01:44:29 +00:00
Rafael Espindola 5450f218a6 Fix the signatures of vfork, __sigsetjmp and sigsetjmp.
Patch by Dimitry Andric.

llvm-svn: 142531
2011-10-19 14:50:34 +00:00
Rafael Espindola 2d21ab024e Add returns_twice to functions that are known to return twice. This implements
the same behavior of gcc by keeping the attribute out of the function type.

llvm-svn: 141803
2011-10-12 19:51:18 +00:00
Anna Zaks fedf5dfc71 [analyzer] Warn about the use of insecure, deprecated vfork() function PR11053 (http://llvm.org/bugs/show_bug.cgi?id=11053).
A patch by Graham Lee!

llvm-svn: 141643
2011-10-11 04:34:54 +00:00
Ted Kremenek 3f955e6d89 [analyzer] rename all experimental checker packages to have 'experimental' be the common root package.
llvm-svn: 136835
2011-08-03 23:14:55 +00:00
Lenny Maiorani de909e4946 Add security syntax checker for strcat() which causes the Static Analyzer to generate a warning any time the strcat() function is used with a note suggesting to use a function which provides bounded buffers. CWE-119.
Also, brings the security syntax checker more inline with coding standards.

llvm-svn: 128916
2011-04-05 20:18:46 +00:00
Lenny Maiorani 6ffe738f24 Add security syntax checker for strcpy() which causes the Static Analyzer to generate a warning any time the strcpy() function is used with a note suggesting to use a function which provides bounded buffers.
llvm-svn: 128679
2011-03-31 22:09:14 +00:00
Ted Kremenek 49c79790de Rework checker "packages" and groups to be more hierarchical.
llvm-svn: 128187
2011-03-24 00:28:47 +00:00
Argyrios Kyrtzidis af45aca670 [analyzer] Use the new registration mechanism on the non-path-sensitive-checkers:
DeadStoresChecker
  ObjCMethSigsChecker
  ObjCUnusedIvarsChecker
  SizeofPointerChecker
  ObjCDeallocChecker
  SecuritySyntaxChecker

llvm-svn: 125779
2011-02-17 21:39:33 +00:00
Ted Kremenek ec5b3d45c1 Rename -cc1 option '-warn-security-syntactic' to '-analyzer-check-security-syntactic'.
llvm-svn: 95342
2010-02-05 01:50:36 +00:00
Eli Friedman 53b3cde60f Add abort() as a builtin. This has two effects: one, we warn for incorrect
declarations of abort(), and two, we mark it noreturn.  Missing the latter
shows up in one of the "embarassing" tests (from the thread on llvmdev
"detailed comparison of generated code size for LLVM and other compilers").

llvm-svn: 91515
2009-12-16 06:28:21 +00:00
Daniel Dunbar 8fbe78f6fc Update tests to use %clang_cc1 instead of 'clang-cc' or 'clang -cc1'.
- This is designed to make it obvious that %clang_cc1 is a "test variable"
   which is substituted. It is '%clang_cc1' instead of '%clang -cc1' because it
   can be useful to redefine what gets run as 'clang -cc1' (for example, to set
   a default target).

llvm-svn: 91446
2009-12-15 20:14:24 +00:00
Zhongxing Xu 27f686f8ec Replace clang-cc with clang -cc1.
llvm-svn: 91272
2009-12-14 06:34:20 +00:00
Zhongxing Xu efd9ae8a85 Add test case for mktemp. Patch by Lei Zhang.
llvm-svn: 90706
2009-12-06 12:45:46 +00:00
Zhongxing Xu d6e7f9d4b2 Add check for obsolete function call of getpw().
llvm-svn: 86537
2009-11-09 12:19:26 +00:00
Ted Kremenek ad5a600a24 Implement: <rdar://problem/6337100> CWE-338: Use of cryptographically weak prng
Patch by Geoff Keating!

llvm-svn: 80752
2009-09-02 02:47:41 +00:00
Ted Kremenek d032fcce5c Implement: <rdar://problem/6337132> CWE-273: Failure to Check Whether Privileges
Were Dropped Successfully

Patch by Geoff Keating!

llvm-svn: 80313
2009-08-28 00:08:09 +00:00
Ted Kremenek 6610c0326b Implement: <rdar://problem/6335715> rule request: gets() buffer overflow
llvm-svn: 76905
2009-07-23 22:29:41 +00:00
Ted Kremenek 9c49762776 Refine checking and diagnostics for use of floating point variable as a counter.
This implements <rdar://problem/6336718> and checks for CERT secure coding
advisory FLP30-C.

llvm-svn: 76900
2009-07-23 21:34:35 +00:00