Commit Graph

1079 Commits

Author SHA1 Message Date
Ted Kremenek 5f06955aa0 Teach static analyzer to analyze Objective-C methods in category implementations.
llvm-svn: 131614
2011-05-19 00:56:53 +00:00
Ted Kremenek 6878c36328 Elide __label__ declarations from the CFG. This resolves a crash in CFGRecStmtDeclVisitor (crash in static analyzer).
llvm-svn: 131141
2011-05-10 18:42:15 +00:00
Lenny Maiorani 5066858bcd Removing strncpy() checking in CString checker for now. Some significant changes need to be made to properly support modeling of it since it potentially leaves strings non-null terminated.
llvm-svn: 130758
2011-05-03 16:34:26 +00:00
Ted Kremenek e9f364f658 Tweak the retain/release checker to not stop tracking retained objects when calling C++ methods. This is a temporary solution to prune false positives until we have a general story using annotations.
llvm-svn: 130726
2011-05-02 21:21:42 +00:00
Ted Kremenek aa181174e7 Augment retain/release checker to not warn about tracked objects passed as arguments to C++ constructors. This is a stop-gap measure for Objective-C++ code that uses smart pointers to manage reference counts.
llvm-svn: 130711
2011-05-02 19:42:42 +00:00
Lenny Maiorani 0b510279c6 Implements strncasecmp() checker and simplifies some of the logic around creating substrings if necessary and calling the appropriate StringRef::compare/compare_lower().
llvm-svn: 130708
2011-05-02 19:05:49 +00:00
Ted Kremenek 8067746554 Move the SelfInit checker to the 'cocoa.experimental' package.
llvm-svn: 130598
2011-04-30 06:46:45 +00:00
Ted Kremenek e8e565ab81 Adjust test/Analysis/retain-release.m to also test the retain/release checker in Objective-C++ mode.
llvm-svn: 130559
2011-04-29 23:15:53 +00:00
Lenny Maiorani 4af23c8159 Implements strcasecmp() checker in Static Analyzer.
llvm-svn: 130398
2011-04-28 15:09:11 +00:00
Lenny Maiorani 005b5c1aee More accurately model realloc() when the size argument is 0. realloc() with a size of 0 is equivalent to free(). The memory region should be marked as free and not used again.
Unit tests f2_realloc_0(), f6_realloc(), and f7_realloc() contributed by Marshall Clow <mclow.lists@gmail.com>. Thanks! 

llvm-svn: 130303
2011-04-27 14:49:29 +00:00
Ted Kremenek 08b434f450 Allow 'Environment::getSVal()' to allow an optional way for checkers to do a direct lookup to values bound to expressions, without
resulting to lazy logic.  This is critical for the OSAtomicChecker that does a simulated load on any arbitrary expression.

llvm-svn: 130292
2011-04-27 05:34:09 +00:00
Argyrios Kyrtzidis a9b630e4d7 Emit a -Wnull-dereference warning for "*null" not just "*null = something". Addresses rdar://9269271.
llvm-svn: 130207
2011-04-26 17:41:22 +00:00
Lenny Maiorani e553e40467 Implements the strncmp() checker just like the strcmp() checker, but with bounds. Requires LLVM svn r129582.
llvm-svn: 130161
2011-04-25 22:21:00 +00:00
Ted Kremenek 11e5c8b31a Add static analyzer support for C++'0X nullptr. Patch by Jim Goodnow II.
llvm-svn: 130003
2011-04-22 18:01:30 +00:00
Anders Carlsson d1f65f61ee Make the VariadicMethodTypeChecker accept block pointers as Objective-C pointers. Fixes PR9746.
llvm-svn: 129741
2011-04-19 01:16:46 +00:00
Richard Smith 0c502d2a62 Fix PR9741. The implicit declarations created for range-based for loops weren't being added to the DeclContext (nor were they being marked as implicit). Also, the declarations were being emitted in the wrong order when building the CFG.
llvm-svn: 129700
2011-04-18 15:49:25 +00:00
Chris Lattner 57540c5be0 fix a bunch of comment typos found by codespell. Patch by
Luis Felipe Strano Moraes!

llvm-svn: 129559
2011-04-15 05:22:18 +00:00
Ted Kremenek ced5feaec9 Teach VariadicMethodTypeChecker to not crash when processing methods declared in protocols.
llvm-svn: 129395
2011-04-12 21:47:05 +00:00
Ted Kremenek 8a4c760c20 ArrayBoundCheckerV2: don't arbitrarily warn about indexing before the 0-index of a symbolic region. In many cases that isn't really the base offset.
llvm-svn: 129366
2011-04-12 17:21:33 +00:00
Lenny Maiorani f3539ad5c7 This patch adds modeling of strcmp() to the CString checker. Validates inputs are not NULL and are real C strings, then does the comparison and binds the proper return value. Unit tests included.
llvm-svn: 129364
2011-04-12 17:08:43 +00:00
Ted Kremenek f52718899f static analyzer: invalidate by-ref arguments passed to constructors in a 'new' expression.
llvm-svn: 129349
2011-04-12 05:12:39 +00:00
Ted Kremenek 57a4a152b2 Fix bug in SimpleSValBuilder where '--' pointer arithmetic was treated like '++' pointer arithmetic.
llvm-svn: 129348
2011-04-12 03:49:37 +00:00
Ted Kremenek 4f939da02d RegionStoreManager::invalidateRegions: treat classes the same as structs.
llvm-svn: 129333
2011-04-12 00:44:31 +00:00
Ted Kremenek e0d2b8c58c Teach GRState::getSValAsScalarOrLoc() about C++ references.
llvm-svn: 129329
2011-04-12 00:28:12 +00:00
Ted Kremenek 8ef59e5c03 C++ static analysis: also invalidate fields of objects that are the callees in C++ method calls.
llvm-svn: 129308
2011-04-11 22:22:05 +00:00
Lenny Maiorani 467dbd5f13 strcat() and strncat() model additions to CStringChecker.
Validates inputs are not NULL, checks for overlapping strings, concatenates the strings checking for buffer overflow, sets the length of the destination string to the sum of the s1 length and the s2 length, binds the return value to the s1 value.

llvm-svn: 129215
2011-04-09 15:12:58 +00:00
Ted Kremenek f603f3afbd Start overhauling static analyzer support for C++ constructors. The inlining support isn't complete, and needs
to be reworked to model CallEnter/CallExit (just like all other calls).  For now, treat constructors mostly
like other function calls, making the analysis of C++ code just a little more useful.

llvm-svn: 129166
2011-04-08 22:42:35 +00:00
John McCall 3337ca5f95 When updating the retain summary based on {cf,ns}_consumed attributes,
be sure to consume the argument index that actually had the attribute
rather than always the first.  rdar://problem/9234108

llvm-svn: 128998
2011-04-06 09:02:12 +00:00
Lenny Maiorani de909e4946 Add security syntax checker for strcat() which causes the Static Analyzer to generate a warning any time the strcat() function is used with a note suggesting to use a function which provides bounded buffers. CWE-119.
Also, brings the security syntax checker more inline with coding standards.

llvm-svn: 128916
2011-04-05 20:18:46 +00:00
Ted Kremenek 378819342e Fix PR 9626 (duplicated self-init warnings under -Wuninitialized) with numerous CFG and UninitializedValues analysis changes:
1) Change the CFG to include the DeclStmt for conditional variables, instead of using the condition itself as a faux DeclStmt.
2) Update ExprEngine (the static analyzer) to understand (1), so not to regress.
3) Update UninitializedValues.cpp to initialize all tracked variables to Uninitialized at the start of the function/method.
4) Only use the SelfReferenceChecker (SemaDecl.cpp) on global variables, leaving the dataflow analysis to handle other cases.

The combination of (1) and (3) allows the dataflow-based -Wuninitialized to find self-init problems when the initializer
contained control-flow.

llvm-svn: 128858
2011-04-04 23:29:12 +00:00
Argyrios Kyrtzidis 3657c006cc Change test/Analysis/idempotent-operations.c to output the .plist file in the test output directory.
llvm-svn: 128849
2011-04-04 22:30:01 +00:00
Ted Kremenek 850d35be16 Fix RegionStore bug when doing a field load whose parent is also a field assigned a LazyCompoundValue. Fixes <rdar://problem/9163742> and PR 9522.
llvm-svn: 128783
2011-04-03 04:09:15 +00:00
Ted Kremenek 8f89f7c893 Teach IdempotentOperationsChecker about paths aborted because ExprEngine didn't know how to handle a specific Expr type.
llvm-svn: 128761
2011-04-02 02:56:23 +00:00
Lenny Maiorani 6ffe738f24 Add security syntax checker for strcpy() which causes the Static Analyzer to generate a warning any time the strcpy() function is used with a note suggesting to use a function which provides bounded buffers.
llvm-svn: 128679
2011-03-31 22:09:14 +00:00
Lenny Maiorani 79d74141b1 Adding Static Analyzer checker for mempcpy().
Models mempcpy() so that if length is NULL the destination pointer is returned. Otherwise, the source and destination are confirmed not to be NULL and not overlapping. Finally the copy is validated to not cause a buffer overrun and the return value is bound to the address of the byte after the last byte copied.

llvm-svn: 128677
2011-03-31 21:36:53 +00:00
Ted Kremenek 40d16c0e75 Static analyzer: fix bug in handling of dynamic_cast<>. The sink node wouldn't always be the final node, thus causing the state to continue propagating. Instead,
recover some path-sensitivity by conjuring a symbol.

llvm-svn: 128612
2011-03-31 04:46:53 +00:00
Ted Kremenek 61a4f6682a Teach static analyzer about the basics of handling new[]. We still don't simulate constructors, but at least the analyzer doesn't think the return value is uninitialized.
llvm-svn: 128611
2011-03-31 04:04:48 +00:00
Ted Kremenek 98a24e37c5 Begin reworking static analyzer support for C++ method calls. The current logic was divorced
from how we process ordinary function calls, had a tremendous about of redundancy, and relied
strictly on inlining behavior (which was incomplete) to provide semantics instead of falling
back to the conservative analysis we use for C functions.  This is a significant step into
making C++ analyzer support more useful.

llvm-svn: 128557
2011-03-30 17:41:19 +00:00
Anders Carlsson 642b03413f Don't add a symbolic region for 'this' if the member function is static.
llvm-svn: 128340
2011-03-26 14:30:44 +00:00
Ted Kremenek 49c79790de Rework checker "packages" and groups to be more hierarchical.
llvm-svn: 128187
2011-03-24 00:28:47 +00:00
Ted Kremenek 70727343cf Teach VariadicMethodTypeChecker about pointers attributed as 'NSObject'.
llvm-svn: 127798
2011-03-17 04:10:25 +00:00
Ted Kremenek 6fa1daede5 Teach VariadicMethodTypeChecker that CF references are valid arguments to variadic Objective-C methods.
llvm-svn: 127797
2011-03-17 04:01:35 +00:00
Ted Kremenek 3e5ad5932e Tweak RegionStore's handling of lazy compound values to use the 'Default' versus 'Direct' binding key, thus allowing specific elements of an array/struct to be overwritten without
invalidating the entire binding.  Fixes PR 9455.

llvm-svn: 127796
2011-03-17 03:51:51 +00:00
Ted Kremenek 4ceebbf54d VariadicMethodTypeChecker: don't warn for null pointer constants passed to variadic Objective-C methods.
llvm-svn: 127719
2011-03-16 00:22:51 +00:00
Ted Kremenek cdb2ae587a Remove bogus assertion in IdempotentOperationsChecker.
llvm-svn: 127687
2011-03-15 19:27:57 +00:00
Ted Kremenek 792798549f Remove old UninitializedValues analysis.
llvm-svn: 127656
2011-03-15 03:17:01 +00:00
Ted Kremenek 066b226daa Tweak VariadicMethodTypeChecker to only create one ExplodedNode when issuing multiple warnings for the same message expression.
Also add a test case showing that we correctly report multiple warnings for the same message expression.

llvm-svn: 127605
2011-03-14 19:50:37 +00:00
Anders Carlsson d91d5f162f Add an Objective-C checker that checks that arguments passed to some variadic Objective-C methods are of Objective-C pointer types.
Ted or Argiris, I'd appreciate a review!

llvm-svn: 127572
2011-03-13 20:35:21 +00:00
Ted Kremenek 53e6538fa8 Fix CFG assertion failure reported in PR 9467. This was due to recent changes in optimizing CFGs for switch statements.
llvm-svn: 127563
2011-03-13 03:48:04 +00:00
Jakob Stoklund Olesen 609e814a4a XFAIL this on windows where <vector> contains surprises.
llvm-svn: 127559
2011-03-13 00:55:43 +00:00