Commit Graph

1936 Commits

Author SHA1 Message Date
Zurab Tsinadze a54d81f597 [analyzer] CERT: POS34-C
Summary:
This patch introduces a new checker:
`alpha.security.cert.pos.34c`

This checker is implemented based on the following rule:
https://wiki.sei.cmu.edu/confluence/x/6NYxBQ
The check warns if  `putenv` function is
called with automatic storage variable as an argument.

Differential Revision: https://reviews.llvm.org/D71433
2020-02-19 18:12:19 +01:00
Artem Dergachev 5a11233a2f [analyzer] VforkChecker: allow execve after vfork.
In the path-sensitive vfork() checker that keeps a list of operations
allowed after a successful vfork(), unforget to include execve() in the list.

Patch by Jan Včelák!

Differential Revision: https://reviews.llvm.org/D73629
2020-02-18 09:19:29 +03:00
Gabor Marton 536456a7e9 [analyzer] StdLibraryFunctionsChecker: Use platform dependent EOF and UCharMax
Summary:
Both EOF and the max value of unsigned char is platform dependent. In this
patch we try our best to deduce the value of EOF from the Preprocessor,
if we can't we fall back to -1.

Reviewers: Szelethus, NoQ

Subscribers: whisperity, xazax.hun, kristof.beyls, baloghadamsoftware, szepet, rnkovacs, a.sidorin, mikhail.ramalh

Tags: #clang

Differential Revision: https://reviews.llvm.org/D74473
2020-02-13 13:51:51 +01:00
Balázs Kéri 5b3983ba37 [analyzer]StreamChecker refactoring (NFC).
Reviewers: Szelethus

Reviewed By: Szelethus

Subscribers: xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, donat.nagy, Charusso, dkrupp, Szelethus, gamesh411, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D73359
2020-02-12 12:50:49 +01:00
Justin Lebar ac66c61bf9 Use C++14-style return type deduction in clang.
Summary:
Simplifies the C++11-style "-> decltype(...)" return-type deduction.

Note that you have to be careful about whether the function return type
is `auto` or `decltype(auto)`.  The difference is that bare `auto`
strips const and reference, just like lambda return type deduction.  In
some cases that's what we want (or more likely, we know that the return
type is a value type), but whenever we're wrapping a templated function
which might return a reference, we need to be sure that the return type
is decltype(auto).

No functional change.

Reviewers: bkramer, MaskRay, martong, shafik

Subscribers: martong, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D74423
2020-02-11 14:41:22 -08:00
Gabor Marton f5086b3803 [analyzer] StdLibraryFunctionsChecker refactor: remove macros
Reviewers: NoQ

Tags: #clang

Differential Revision: https://reviews.llvm.org/D73897
2020-02-10 16:45:33 +01:00
Balázs Kéri c4f0f8ec41 [analyzer] Small StreamChecker refactoring (NFC).
Reviewers: Szelethus

Reviewed By: Szelethus

Subscribers: xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, donat.nagy, Charusso, dkrupp, Szelethus, gamesh411, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D73350
2020-02-07 11:35:46 +01:00
Gabor Horvath 643dee903c [analyzer] Move fuchsia.Lock checker to alpha
Differential Revision: https://reviews.llvm.org/D74004
2020-02-05 16:11:06 -08:00
Gabor Horvath e4f4a6c0f5 [analyzer] Prevent an assertion failure in PThreadLockChecker
When the implementations of the locking functions are available.

Differential Revision: https://reviews.llvm.org/D74003
2020-02-05 15:56:56 -08:00
Adam Balogh b198f16e1e [Analyzer] Model STL Algoirthms to improve the iterator checkers
STL Algorithms are usually implemented in a tricky for performance
reasons which is too complicated for the analyzer. Furthermore inlining
them is costly. Instead of inlining we should model their behavior
according to the specifications.

This patch is the first step towards STL Algorithm modeling. It models
all the `find()`-like functions in a simple way: the result is either
found or not. In the future it can be extended to only return success if
container modeling is also extended in a way the it keeps track of
trivial insertions and deletions.

Differential Revision: https://reviews.llvm.org/D70818
2020-02-05 17:59:08 +01:00
Charusso af3d0d1628 [analyzer] DynamicSize: Remove 'getSizeInElements()' from store
Summary:
This patch uses the new `DynamicSize.cpp` to serve dynamic information.
Previously it was static and probably imprecise data.

Reviewed By: NoQ

Differential Revision: https://reviews.llvm.org/D69599
2020-01-30 16:51:48 +01:00
Charusso 601687bf73 [analyzer] DynamicSize: Remove 'getExtent()' from regions
Summary:
This patch introduces a placeholder for representing the dynamic size of
regions. It also moves the `getExtent()` method of `SubRegions` to the
`MemRegionManager` as `getStaticSize()`.

Reviewed By: NoQ

Differential Revision: https://reviews.llvm.org/D69540
2020-01-30 16:05:18 +01:00
Adam Balogh 9a08a3fab9 [Analyzer] Split container modeling from iterator modeling
Iterator modeling depends on container modeling,
but not vice versa. This enables the possibility
to arrange these two modeling checkers into
separate layers.

There are several advantages for doing this: the
first one is that this way we can keep the
respective modeling checkers moderately simple
and small. Furthermore, this enables creation of
checkers on container operations which only
depend on the container modeling. Thus iterator
modeling can be disabled together with the
iterator checkers if they are not needed.

Since many container operations also affect
iterators, container modeling also uses the
iterator library: it creates iterator positions
upon calling the `begin()` or `end()` method of
a containter (but propagation of the abstract
position is left to the iterator modeling),
shifts or invalidates iterators according to the
rules upon calling a container modifier and
rebinds the iterator to a new container upon
`std::move()`.

Iterator modeling propagates the abstract
iterator position, handles the relations between
iterator positions and models iterator
operations such as increments and decrements.

Differential Revision: https://reviews.llvm.org/D73547
2020-01-29 16:10:45 +01:00
Benjamin Kramer adcd026838 Make llvm::StringRef to std::string conversions explicit.
This is how it should've been and brings it more in line with
std::string_view. There should be no functional change here.

This is mostly mechanical from a custom clang-tidy check, with a lot of
manual fixups. It uncovers a lot of minor inefficiencies.

This doesn't actually modify StringRef yet, I'll do that in a follow-up.
2020-01-28 23:25:25 +01:00
Gabor Horvath f4c26d993b [analyzer] Add FuchsiaLockChecker and C11LockChecker
These are mostly trivial additions as both of them are reusing existing
PThreadLockChecker logic. I only needed to add the list of functions to
check and do some plumbing to make sure that we display the right
checker name in the diagnostic.

Differential Revision: https://reviews.llvm.org/D73376
2020-01-27 13:55:56 -08:00
Mikhail Gadelha 88c7b16420 [analyzer] Simplify BoolAssignmentChecker
Summary:
Instead of checking the range manually, changed the checker to use assumeInclusiveRangeDual instead.

This patch was part of D28955.

Reviewers: NoQ

Reviewed By: NoQ

Subscribers: ddcc, xazax.hun, baloghadamsoftware, szepet, a.sidorin, Szelethus, donat.nagy, dkrupp, Charusso, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D73062
2020-01-27 14:51:35 -04:00
Gabor Horvath c98d98ba9b [analyzer] Fix handle leak false positive when the handle dies too early
Differential Revision: https://reviews.llvm.org/D73151
2020-01-27 09:52:06 -08:00
Artem Dergachev 1484d0f12a [analyzer] PthreadLock: Implement dead region cleanup.
Differential Revision: https://reviews.llvm.org/D37963
2020-01-24 18:43:24 +03:00
Artem Dergachev dd22be1e3d [analyzer] PthreadLock: Implement mutex escaping.
Differential Revision: https://reviews.llvm.org/D37812
2020-01-24 18:43:24 +03:00
Artem Dergachev 152bc7ffdc [analyzer] NFC: PthreadLock: Use CallDescriptionMap, modernize.
https://reviews.llvm.org/D37809
2020-01-24 18:43:23 +03:00
Artem Dergachev 15624a7bda [analyzer] PthreadLock: Add more XNU rwlock unlock functions.
Differential Revision: https://reviews.llvm.org/D37807
2020-01-24 18:43:23 +03:00
Artem Dergachev 80fd37f9d6 [analyzer] PthreadLock: Fix return value modeling for XNU lock functions.
Differential Revision: https://reviews.llvm.org/D37806
2020-01-24 18:43:23 +03:00
Gabor Horvath 5911268e44 [analyzer] Improve FuchsiaHandleChecker's diagnostic messages
Differential Revision: https://reviews.llvm.org/D73229
2020-01-23 09:16:40 -08:00
Benjamin Kramer df186507e1 Make helper functions static or move them into anonymous namespaces. NFC. 2020-01-14 14:06:37 +01:00
Simon Pilgrim ad201691d5 Fix "pointer is null" static analyzer warnings. NFCI.
Use cast<> instead of dyn_cast<> and move into its users where its dereferenced immediately.
2020-01-12 14:36:59 +00:00
Gabor Marton 5e7beb0a41 [analyzer] Add PlacementNewChecker
Summary:
This checker verifies if default placement new is provided with pointers
to sufficient storage capacity.

Noncompliant Code Example:
  #include <new>
  void f() {
    short s;
    long *lp = ::new (&s) long;
  }

Based on SEI CERT rule MEM54-CPP
https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM54-CPP.+Provide+placement+new+with+properly+aligned+pointe
This patch does not implement checking of the alignment.

Reviewers: NoQ, xazax.hun

Subscribers: mgorny, whisperity, xazax.hun, baloghadamsoftware, szepet,
rnkovacs, a.sidorin, mikhail.ramalho, donat

Tags: #clang

Differential Revision: https://reviews.llvm.org/D71612
2020-01-10 17:59:06 +01:00
Mark de Wever 8dc7b982b4 [NFC] Fixes -Wrange-loop-analysis warnings
This avoids new warnings due to D68912 adds -Wrange-loop-analysis to -Wall.

Differential Revision: https://reviews.llvm.org/D71857
2020-01-01 20:01:37 +01:00
Mark de Wever b6d9e97662 [Analyzer] Fixes -Wrange-loop-analysis warnings
This avoids new warnings due to D68912 adds -Wrange-loop-analysis to -Wall.

Differential Revision: https://reviews.llvm.org/D71809
2019-12-22 19:13:34 +01:00
Mark de Wever 70d592d68c [Analyzer] Use a reference in a range-based for
This avoids unneeded copies when using a range-based for loops.

This avoids new warnings due to D68912 adds -Wrange-loop-analysis to -Wall.

Differential Revision: https://reviews.llvm.org/D70869
2019-12-21 14:52:29 +01:00
Gabor Horvath 59878ec809 [analyzer] Add path notes to FuchsiaHandleCheck.
Differential Revision: https://reviews.llvm.org/D70725
2019-12-20 12:40:41 -08:00
Gabor Horvath 82923c71ef [analyzer] Add Fuchsia Handle checker
The checker can diagnose handle use after releases, double releases, and
handle leaks.

Differential Revision: https://reviews.llvm.org/D70470
2019-12-20 12:33:16 -08:00
Artem Dergachev b284005072 [analyzer] Add a syntactic security check for ObjC NSCoder API.
Method '-[NSCoder decodeValueOfObjCType:at:]' is not only deprecated
but also a security hazard, hence a loud check.

Differential Revision: https://reviews.llvm.org/D71728
2019-12-19 14:54:29 -08:00
Artem Dergachev bce1cce6bf [analyzer] Teach MismatchedDealloc about initWithBytesNoCopy with deallocator.
MallocChecker warns when memory is passed into -[NSData initWithBytesNoCopy]
but isn't allocated by malloc(), because it will be deallocated by free().
However, initWithBytesNoCopy has an overload that takes an arbitrary block
for deallocating the object. If such overload is used, it is no longer
necessary to make sure that the memory is allocated by malloc().
2019-12-18 14:19:17 -08:00
Artem Dergachev badba5118f [analyzer] NonnullGlobalConstants: Add support for kCFNull.
It's a singleton in CoreFoundation that always contains a non-null CFNullRef.
2019-12-18 12:08:15 -08:00
Borsik Gabor 273e674252 [analyzer] Add support for namespaces to GenericTaintChecker
This patch introduces the namespaces for the configured functions and
also enables the use of the member functions.

I added an optional Scope field for every configured function. Functions
without Scope match for every function regardless of the namespace.
Functions with Scope will match if the full name of the function starts
with the Scope.
Multiple functions can exist with the same name.

Differential Revision: https://reviews.llvm.org/D70878
2019-12-15 12:11:22 +01:00
Artem Dergachev f450dd63a1 [analyzer] CStringChecker: Fix a crash on unknown value passed to strlcat.
Checkers should always account for unknown values.

Also use a slightly more high-level API that naturally avoids the problem.
2019-12-13 18:00:24 -08:00
Gabor Horvath 5882e6f36f [analyzer] Escape symbols conjured into specific regions during a conservative EvalCall
This patch introduced additional PointerEscape callbacks after conservative
calls for output parameters. This should not really affect the current
checkers but the upcoming FuchsiaHandleChecker relies on this heavily.

Differential Revision: https://reviews.llvm.org/D71224
2019-12-11 11:44:10 -08:00
Artem Dergachev b01012b7c8 [analyzer] LocalizationChecker: Fix a crash on synthesized accessor stubs.
The checker was trying to analyze the body of every method in Objective-C
@implementation clause but the sythesized accessor stubs that were introduced
into it by 2073dd2d have no bodies.
2019-12-11 11:22:36 -08:00
Artem Dergachev 2b3f2071ec [analyzer] CStringChecker: Fix overly eager assumption that memcmp args overlap.
While analyzing code `memcmp(a, NULL, n);', where `a' has an unconstrained
symbolic value, the analyzer was emitting a warning about the *first* argument
being a null pointer, even though we'd rather have it warn about the *second*
argument.

This happens because CStringChecker first checks whether the two argument
buffers are in fact the same buffer, in order to take the fast path.
This boils down to assuming `a == NULL' to true. Then the subsequent check
for null pointer argument "discovers" that `a' is null.

Don't take the fast path unless we are *sure* that the buffers are the same.
Otherwise proceed as normal.

Differential Revision: https://reviews.llvm.org/D71322
2019-12-11 11:22:36 -08:00
Artem Dergachev 134faae042 [analyzer] CStringChecker: Improve warning messages.
Differential Revision: https://reviews.llvm.org/D71321
2019-12-11 11:22:36 -08:00
Adam Balogh 855d21a03a [Analyzer] Iterator Checkers: Replace `UnknownVal` in comparison result by a conjured value
Sometimes the return value of a comparison operator call is
`UnkownVal`. Since no assumptions can be made on `UnknownVal`,
this leeds to keeping impossible execution paths in the
exploded graph resulting in poor performance and false
positives. To overcome this we replace unknown results of
iterator comparisons by conjured symbols.

Differential Revision: https://reviews.llvm.org/D70244
2019-12-11 15:24:06 +01:00
Adam Balogh 6e9c58946e [Analyzer] Iterator Modeling: Print Container Data and Iterator Positions when printing the Program State
Debugging the Iterator Modeling checker or any of the iterator checkers
is difficult without being able to see the relations between the
iterator variables and their abstract positions, as well as the abstract
symbols denoting the begin and the end of the container.

This patch adds the checker-specific part of the Program State printing
to the Iterator Modeling checker.
2019-12-11 14:20:17 +01:00
Adam Balogh afb13afcf2 [Analyzer][NFC] Iterator Checkers - Separate iterator modeling and the actual checkers
A monolithic checker class is hard to maintain. This patch splits it up
into a modeling part, the three checkers and a debug checker. The common
functions are moved into a library.

Differential Revision: https://reviews.llvm.org/D70320
2019-12-11 13:06:19 +01:00
Reid Kleckner 60573ae6fe Remove Expr.h include from ASTContext.h, NFC
ASTContext.h is popular, prune its includes. Expr.h brings in Attr.h,
which is also expensive.

Move BlockVarCopyInit to Expr.h to accomplish this.
2019-12-06 15:30:49 -08:00
Michael Liao f2ace9d600 Add `QualType::hasAddressSpace`. NFC.
- Add that as a shorthand of <T>.getQualifiers().hasAddressSpace().
- Simplify related code.
2019-12-06 13:08:55 -05:00
Balázs Kéri 7eafde981c [Checkers] Added support for freopen to StreamChecker.
Summary: Extend StreamChecker with a new evaluation function for API call 'freopen'.

Reviewers: NoQ, baloghadamsoftware, Szelethus, martong

Reviewed By: baloghadamsoftware, martong

Subscribers: martong, rnkovacs, dkrupp, Szelethus, gamesh411, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D69948
2019-12-05 11:08:44 +01:00
Tyker 2f96047275 [NFCI] update formating for misleading indentation warning
Reviewers: xbolva00

Reviewed By: xbolva00

Differential Revision: https://reviews.llvm.org/D70861
2019-12-03 21:21:27 +01:00
Borsik Gabor 89bc4c662c [analyzer] Add custom filter functions for GenericTaintChecker
This patch is the last of the series of patches which allow the user to
annotate their functions with taint propagation rules.

I implemented the use of the configured filtering functions. These
functions can remove taintedness from the symbols which are passed at
the specified arguments to the filters.

Differential Revision: https://reviews.llvm.org/D59516
2019-11-23 20:12:15 +01:00
Tyker b0561b3346 [NFC] Refactor representation of materialized temporaries
Summary:
this patch refactor representation of materialized temporaries to prevent an issue raised by rsmith in https://reviews.llvm.org/D63640#inline-612718

Reviewers: rsmith, martong, shafik

Reviewed By: rsmith

Subscribers: thakis, sammccall, ilya-biryukov, rnkovacs, arphaman, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D69360
2019-11-19 18:20:45 +01:00
Nico Weber c9276fbfdf Revert "[NFC] Refactor representation of materialized temporaries"
This reverts commit 08ea1ee2db.
It broke ./ClangdTests/FindExplicitReferencesTest.All
on the bots, see comments on https://reviews.llvm.org/D69360
2019-11-17 02:09:25 -05:00
Tyker 08ea1ee2db [NFC] Refactor representation of materialized temporaries
Summary:
this patch refactor representation of materialized temporaries to prevent an issue raised by rsmith in https://reviews.llvm.org/D63640#inline-612718

Reviewers: rsmith, martong, shafik

Reviewed By: rsmith

Subscribers: rnkovacs, arphaman, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D69360
2019-11-16 17:56:09 +01:00
Sylvestre Ledru 9b40a7f3bf Remove +x permission on some files 2019-11-16 14:47:20 +01:00
Artem Dergachev 57adc37fe5 [analyzer] Nullability: Don't infer nullable when passing as nullable parameter.
You can't really infer anything from that.
2019-11-08 18:27:14 -08:00
Adrian Prantl 2073dd2da7 Redeclare Objective-C property accessors inside the ObjCImplDecl in which they are synthesized.
This patch is motivated by (and factored out from)
https://reviews.llvm.org/D66121 which is a debug info bugfix. Starting
with DWARF 5 all Objective-C methods are nested inside their
containing type, and that patch implements this for synthesized
Objective-C properties.

1. SemaObjCProperty populates a list of synthesized accessors that may
   need to inserted into an ObjCImplDecl.

2. SemaDeclObjC::ActOnEnd inserts forward-declarations for all
   accessors for which no override was provided into their
   ObjCImplDecl. This patch does *not* synthesize AST function
   *bodies*. Moving that code from the static analyzer into Sema may
   be a good idea though.

3. Places that expect all methods to have bodies have been updated.

I did not update the static analyzer's inliner for synthesized
properties to point back to the property declaration (see
test/Analysis/Inputs/expected-plists/nullability-notes.m.plist), which
I believed to be more bug than a feature.

Differential Revision: https://reviews.llvm.org/D68108

rdar://problem/53782400
2019-11-08 08:23:22 -08:00
Adam Balogh 0f88caeef8 [Analyzer] Checker for Debugging Iterator Checkers
For white-box testing correct container and iterator modelling it is essential
to access the internal data structures stored for container and iterators. This
patch introduces a simple debug checkers called debug.IteratorDebugging to
achieve this.

Differential Revision: https://reviews.llvm.org/D67156
2019-11-08 08:59:50 +01:00
Artem Dergachev acac540422 [analyzer] PR41729: CStringChecker: Improve strlcat and strlcpy modeling.
- Fix false positive reports of strlcat.
- The return value of strlcat and strlcpy is now correctly calculated.
- The resulting string length of strlcat and strlcpy is now correctly
  calculated.

Patch by Daniel Krupp!

Differential Revision: https://reviews.llvm.org/D66049
2019-11-07 17:15:53 -08:00
Balázs Kéri 4980c1333f [clang][analyzer] Using CallDescription in StreamChecker.
Summary:
Recognization of function names is done now with the CallDescription
class instead of using IdentifierInfo. This means function name and
argument count is compared too.
A new check for filtering not global-C-functions was added.
Test was updated.

Reviewers: Szelethus, NoQ, baloghadamsoftware, Charusso

Reviewed By: Szelethus, NoQ, Charusso

Subscribers: rnkovacs, xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, donat.nagy, Charusso, dkrupp, Szelethus, gamesh411, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D67706
2019-10-31 12:38:50 +01:00
Simon Pilgrim 2c775709f6 BlockInCriticalSectionChecker - silence static analyzer dyn_cast null dereference warning. NFCI.
The static analyzer is warning about a potential null dereference, but we should be able to use cast<> directly and if not assert will fire for us.

llvm-svn: 374717
2019-10-13 11:30:06 +00:00
Alex Langford 86c3af9029 [NFCI] Return PathSensitiveBugReport where appropriate
Some compilers have trouble converting unique_ptr<PathSensitiveBugReport> to
unique_ptr<BugReport> causing some functions to fail to compile.
Changing the return type of the functions that fail to compile does not
appear to have any issues.
I ran into this issue building with clang 3.8 on Ubuntu 16.04.

llvm-svn: 372668
2019-09-23 22:24:47 +00:00
Benjamin Kramer 1b38002c7d Move classes into anonymous namespaces. NFC.
llvm-svn: 372495
2019-09-22 09:28:47 +00:00
Kristof Umann c90fda6abe Attempt to fix a windows buildbot failure
llvm-svn: 372462
2019-09-21 07:56:40 +00:00
Kristof Umann 96be6f485c Fix a documentation error
llvm-svn: 372419
2019-09-20 18:28:04 +00:00
Kristof Umann 951cd32f4b Reland '[analyzer][MallocChecker][NFC] Document and reorganize some functions'
Differential Revision: https://reviews.llvm.org/D54823

llvm-svn: 372414
2019-09-20 17:59:20 +00:00
Kristof Umann 72649423c0 [analyzer][NFC] Fix inconsistent references to checkers as "checks"
Traditionally, clang-tidy uses the term check, and the analyzer uses checker,
but in the very early years, this wasn't the case, and code originating from the
early 2010's still incorrectly refer to checkers as checks.

This patch attempts to hunt down most of these, aiming to refer to checkers as
checkers, but preserve references to callback functions (like checkPreCall) as
checks.

Differential Revision: https://reviews.llvm.org/D67140

llvm-svn: 371760
2019-09-12 19:09:24 +00:00
Artem Dergachev f0bb45fac3 [analyzer] NFC: Move PathDiagnostic classes to libAnalysis.
At this point the PathDiagnostic, PathDiagnosticLocation, PathDiagnosticPiece
structures no longer rely on anything specific to Static Analyzer, so we can
move them out of it for everybody to use.

PathDiagnosticConsumers are still to be handed off.

Differential Revision: https://reviews.llvm.org/D67419

llvm-svn: 371661
2019-09-11 20:54:27 +00:00
Artem Dergachev 6b85f8e99b [analyzer] NFC: Move getStmt() and createEndOfPath() out of PathDiagnostic.
These static functions deal with ExplodedNodes which is something we don't want
the PathDiagnostic interface to know anything about, as it's planned to be
moved out of libStaticAnalyzerCore.

Differential Revision: https://reviews.llvm.org/D67382

llvm-svn: 371659
2019-09-11 20:54:21 +00:00
Artem Dergachev 8535b8ecf2 [analyzer] NFC: Re-implement stack hints as a side map in BugReport.
That's one of the few random entities in the PathDiagnostic interface that
are specific to the Static Analyzer. By moving them out we could let
everybody use path diagnostics without linking against Static Analyzer.

Differential Revision: https://reviews.llvm.org/D67381

llvm-svn: 371658
2019-09-11 20:54:17 +00:00
Artem Dergachev 2f169e7cdd [analyzer] NFC: Introduce sub-classes for path-sensitive and basic reports.
Checkers are now required to specify whether they're creating a
path-sensitive report or a path-insensitive report by constructing an
object of the respective type.

This makes BugReporter more independent from the rest of the Static Analyzer
because all Analyzer-specific code is now in sub-classes.

Differential Revision: https://reviews.llvm.org/D66572

llvm-svn: 371450
2019-09-09 20:34:40 +00:00
Gabor Borsik 080ecafdd8 Move prop-sink branch to monorepo.
llvm-svn: 371342
2019-09-08 19:23:43 +00:00
Artem Dergachev 6cee434ed1 [analyzer] Add minimal support for fix-it hints.
Allow attaching fixit hints to Static Analyzer BugReports.

Fixits are attached either to the bug report itself or to its notes
(path-sensitive event notes or path-insensitive extra notes).

Add support for fixits in text output (including the default text output that
goes without notes, as long as the fixit "belongs" to the warning).

Add support for fixits in the plist output mode.

Implement a fixit for the path-insensitive DeadStores checker. Only dead
initialization warning is currently covered.

Implement a fixit for the path-sensitive VirtualCall checker when the virtual
method is not pure virtual (in this case the "fix" is to suppress the warning
by qualifying the call).

Both fixits are under an off-by-default flag for now, because they
require more careful testing.

Differential Revision: https://reviews.llvm.org/D65182

llvm-svn: 371257
2019-09-06 20:55:29 +00:00
Artem Dergachev 2b1b4cab96 [analyzer] pr43179: Make CallDescription defensive against C variadic functions.
Most functions that our checkers react upon are not C-style variadic functions,
and therefore they have as many actual arguments as they have formal parameters.

However, it's not impossible to define a variadic function with the same name.
This will crash any checker that relies on CallDescription to check the number
of arguments but silently assumes that the number of parameters is the same.

Change CallDescription to check both the number of arguments and the number of
parameters by default.

If we're intentionally trying to match variadic functions, allow specifying
arguments and parameters separately (possibly omitting any of them).
For now we only have one CallDescription which would make use of those,
namely __builtin_va_start itself.

Differential Revision: https://reviews.llvm.org/D67019

llvm-svn: 371256
2019-09-06 20:55:24 +00:00
Benjamin Kramer 0581a44e02 Unbreak the build after r370798
llvm-svn: 370807
2019-09-03 18:24:56 +00:00
Kristof Umann 1b439659a8 [analyzer] NonNullParamChecker and CStringChecker parameter number in checker message
There are some functions which can't be given a null pointer as parameter either
because it has a nonnull attribute or it is declared to have undefined behavior
(e.g. strcmp()). Sometimes it is hard to determine from the checker message
which parameter is null at the invocation, so now this information is included
in the message.

This commit fixes https://bugs.llvm.org/show_bug.cgi?id=39358

Reviewed By: NoQ, Szelethus, whisperity

Patch by Tibor Brunner!

Differential Revision: https://reviews.llvm.org/D66333

llvm-svn: 370798
2019-09-03 17:57:01 +00:00
Kristof Umann 3b18b050b8 [analyzer] Add a checker option to detect nested dead stores
Enables the users to specify an optional flag which would warn for more dead
stores.
Previously it ignored if the dead store happened e.g. in an if condition.

if ((X = generate())) { // dead store to X
}

This patch introduces the `WarnForDeadNestedAssignments` option to the checker,
which is `false` by default - so this change would not affect any previous
users.
I have updated the code, tests and the docs as well. If I missed something, tell
me.

I also ran the analysis on Clang which generated 14 more reports compared to the
unmodified version. All of them seemed reasonable for me.

Related previous patches:
rGf224820b45c6847b91071da8d7ade59f373b96f3

Reviewers: NoQ, krememek, Szelethus, baloghadamsoftware

Reviewed By: Szelethus

Patch by Balázs Benics!

Differential Revision: https://reviews.llvm.org/D66733

llvm-svn: 370767
2019-09-03 15:22:43 +00:00
Adam Balogh 12f5c7f0c3 [Analyzer] Iterator Checkers - Make range errors and invalidated access fatal
Range errors (dereferencing or incrementing the past-the-end iterator or
decrementing the iterator of the first element of the range) and access of
invalidated iterators lead to undefined behavior. There is no point to
continue the analysis after such an error on the same execution path, but
terminate it by a sink node (fatal error). This also improves the
performance and helps avoiding double reports (e.g. in case of nested
iterators).

Differential Revision: https://reviews.llvm.org/D62893

llvm-svn: 370314
2019-08-29 09:35:47 +00:00
Artem Dergachev 630f7daf80 [analyzer] Fix analyzer warnings on analyzer.
Write tests for the actual crash that was found. Write comments and refactor
code around 17 style bugs and suppress 3 false positives.

Differential Revision: https://reviews.llvm.org/D66847

llvm-svn: 370246
2019-08-28 18:44:38 +00:00
Kristof Umann 09ce8ec78a [analyzer] Avoid unnecessary enum range check on LValueToRValue casts
Summary: EnumCastOutOfRangeChecker should not perform enum range checks on LValueToRValue casts, since this type of cast does not actually change the underlying type.   Performing the unnecessary check actually triggered an assertion failure deeper in EnumCastOutOfRange for certain input (which is captured in the accompanying test code).

Reviewers: #clang, Szelethus, gamesh411, NoQ

Reviewed By: Szelethus, gamesh411, NoQ

Subscribers: NoQ, gamesh411, xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, Charusso, bjope, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D66014

llvm-svn: 369760
2019-08-23 14:21:13 +00:00
Artem Dergachev 85f7294e5a [analyzer] CastValueChecker: Correctly model results of based-to-derived casts.
Our SVal hierarchy doesn't allow modeling pointer casts as no-op. The
pointer type is instead encoded into the pointer object. Defer to our
usual pointer casting facility, SValBuilder::evalBinOp().

Fixes a crash.

llvm-svn: 369729
2019-08-23 03:24:04 +00:00
Artem Dergachev 62a76d0ae3 [analyzer] CastValueChecker: Provide DynamicTypeMap with pointer types only.
The idea to drop this requirement is good, but for now every other user
of DynamicTypeInfo expects pointer types.

Fixes a crash.

llvm-svn: 369728
2019-08-23 03:24:01 +00:00
Artem Dergachev af992e6d01 [analyzer] CastValueChecker: Avoid modeling casts between objects.
Our method only works correctly when casting a pointer to a pointer
or a reference to a reference.

Fixes a crash.

llvm-svn: 369727
2019-08-23 03:23:58 +00:00
Haojian Wu fcedc6a61b Remove an unused function, suppress -Wunused-function warning.
llvm-svn: 369629
2019-08-22 08:49:41 +00:00
Csaba Dabis 4d71600c11 [analyzer] CastValueChecker: Model isa(), isa_and_nonnull()
Summary: -

Reviewed By: NoQ

Differential Revision: https://reviews.llvm.org/D66423

llvm-svn: 369615
2019-08-22 02:57:59 +00:00
Csaba Dabis 22dc44ff89 [analyzer] CastValueChecker: Try to fix the buildbots
llvm-svn: 369609
2019-08-22 01:41:06 +00:00
Csaba Dabis e4bf456fce [analyzer] CastValueChecker: Rewrite dead header hotfix
llvm-svn: 369607
2019-08-22 00:36:42 +00:00
Csaba Dabis 0202c3596c [analyzer] CastValueChecker: Store the dynamic types and casts
Summary:
This patch introduces `DynamicCastInfo` similar to `DynamicTypeInfo` which
is stored in `CastSets` which are storing the dynamic cast informations of
objects based on memory regions. It could be used to store and check the
casts and prevent infeasible paths.

Reviewed By: NoQ

Differential Revision: https://reviews.llvm.org/D66325

llvm-svn: 369605
2019-08-22 00:20:36 +00:00
Artem Dergachev d3971fe97b [analyzer] Improve VirtualCallChecker and enable parts of it by default.
Calling a pure virtual method during construction or destruction
is undefined behavior. It's worth it to warn about it by default.
That part is now known as the cplusplus.PureVirtualCall checker.

Calling a normal virtual method during construction or destruction
may be fine, but does behave unexpectedly, as it skips virtual dispatch.
Do not warn about this by default, but let projects opt in into it
by enabling the optin.cplusplus.VirtualCall checker manually.

Give the two parts differentiated warning text:

  Before:

    Call to virtual function during construction or destruction:
    Call to pure virtual function during construction

    Call to virtual function during construction or destruction:
    Call to virtual function during destruction

  After:

    Pure virtual method call:
    Call to pure virtual method 'X::foo' during construction
        has undefined behavior

    Unexpected loss of virtual dispatch:
    Call to virtual method 'Y::bar' during construction
        bypasses virtual dispatch

Also fix checker names in consumers that support them (eg., clang-tidy)
because we now have different checker names for pure virtual calls and
regular virtual calls.

Also fix capitalization in the bug category.

Differential Revision: https://reviews.llvm.org/D64274

llvm-svn: 369449
2019-08-20 21:41:14 +00:00
Jonas Devlieghere 2b3d49b610 [Clang] Migrate llvm::make_unique to std::make_unique
Now that we've moved to C++14, we no longer need the llvm::make_unique
implementation from STLExtras.h. This patch is a mechanical replacement
of (hopefully) all the llvm::make_unique instances across the monorepo.

Differential revision: https://reviews.llvm.org/D66259

llvm-svn: 368942
2019-08-14 23:04:18 +00:00
Alex Langford 21872bc9bf [analyzer] Don't delete TaintConfig copy constructor
Summary:
Explicitly deleting the copy constructor makes compiling the function
`ento::registerGenericTaintChecker` difficult with some compilers. When we
construct an `llvm::Optional<TaintConfig>`, the optional is constructed with a
const TaintConfig reference which it then uses to invoke the deleted TaintConfig
copy constructor.

I've observered this failing with clang 3.8 on Ubuntu 16.04.

Reviewers: compnerd, Szelethus, boga95, NoQ, alexshap

Subscribers: xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, Charusso, llvm-commits, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D66192

llvm-svn: 368779
2019-08-14 01:09:07 +00:00
Kristof Umann 3f7c66d551 [analyzer][NFC] Prepare visitors for different tracking kinds
When we're tracking a variable that is responsible for a null pointer
dereference or some other sinister programming error, we of course would like to
gather as much information why we think that the variable has that specific
value as possible. However, the newly introduced condition tracking shows that
tracking all values this thoroughly could easily cause an intolerable growth in
the bug report's length.

There are a variety of heuristics we discussed on the mailing list[1] to combat
this, all of them requiring to differentiate in between tracking a "regular
value" and a "condition".

This patch introduces the new `bugreporter::TrackingKind` enum, adds it to
several visitors as a non-optional argument, and moves some functions around to
make the code a little more coherent.

[1] http://lists.llvm.org/pipermail/cfe-dev/2019-June/062613.html

Differential Revision: https://reviews.llvm.org/D64270

llvm-svn: 368777
2019-08-14 00:48:57 +00:00
Kristof Umann e1117addd6 [analyzer][NFC] Make sure that the BugReport is not modified during the construction of non-visitor pieces
I feel this is kinda important, because in a followup patch I'm adding different
kinds of interestingness, and propagating the correct kind in BugReporter.cpp is
just one less thing to worry about.

Differential Revision: https://reviews.llvm.org/D65578

llvm-svn: 368755
2019-08-13 22:03:08 +00:00
Kristof Umann fc76d8551f [analyzer][NFC] Refactoring BugReporter.cpp P4.: If it can be const, make it const
When I'm new to a file/codebase, I personally find C++'s strong static type
system to be a great aid. BugReporter.cpp is still painful to read however:
function calls are made with mile long parameter lists, seemingly all of them
taken with a non-const reference/pointer. This patch fixes nothing but this:
make a few things const, and hammer it until it compiles.

Differential Revision: https://reviews.llvm.org/D65382

llvm-svn: 368735
2019-08-13 18:48:08 +00:00
Kristof Umann 6d716ef181 [analyzer][NFC] Refactoring BugReporter.cpp P3.: std::shared_pointer<PathDiagnosticPiece> -> PathDiagnosticPieceRef
find clang/ -type f -exec sed -i 's/std::shared_ptr<PathDiagnosticPiece>/PathDiagnosticPieceRef/g' {} \;
git diff -U3 --no-color HEAD^ | clang-format-diff-6.0 -p1 -i

Just as C++ is meant to be refactored, right?

Differential Revision: https://reviews.llvm.org/D65381

llvm-svn: 368717
2019-08-13 16:45:48 +00:00
Csaba Dabis cf229d5752 [analyzer] CastValueChecker: Model castAs(), getAs()
Summary: Thanks to Kristóf Umann for the great idea!

Reviewed By: NoQ

Differential Revision: https://reviews.llvm.org/D65889

llvm-svn: 368383
2019-08-09 02:24:42 +00:00
Adam Balogh 8557f17d88 [Analyzer] Iterator Checkers - Fix for Crash on Iterator Differences
Iterators differences were mistakenly handled as random decrements which
causes an assertion. This patch fixes this.

llvm-svn: 367802
2019-08-05 06:45:41 +00:00
Gabor Borsik 2c8098374b Buildbot fix for r367190
llvm-svn: 367193
2019-07-28 14:57:41 +00:00
Gabor Borsik 4bde15fe1e [analyzer] Add yaml parser to GenericTaintChecker
While we implemented taint propagation rules for several
builtin/standard functions, there's a natural desire for users to add
such rules to custom functions.

A series of patches will implement an option that allows users to
annotate their functions with taint propagation rules through a YAML
file. This one adds parsing of the configuration file, which may be
specified in the commands line with the analyzer config:
alpha.security.taint.TaintPropagation:Config. The configuration may
contain propagation rules, filter functions (remove taint) and sink
functions (give a warning if it gets a tainted value).

I also added a new header for future checkers to conveniently read YAML
files as checker options.

Differential Revision: https://reviews.llvm.org/D59555

llvm-svn: 367190
2019-07-28 13:38:04 +00:00
Csaba Dabis 68983321cc [analyzer] MallocChecker: Prevent Integer Set Library false positives
Summary:
Integer Set Library using retain-count based allocation which is not
modeled in MallocChecker.

Reviewed By: NoQ

Tags: #clang

Differential Revision: https://reviews.llvm.org/D64680

llvm-svn: 366391
2019-07-18 00:03:55 +00:00
Rui Ueyama 49a3ad21d6 Fix parameter name comments using clang-tidy. NFC.
This patch applies clang-tidy's bugprone-argument-comment tool
to LLVM, clang and lld source trees. Here is how I created this
patch:

$ git clone https://github.com/llvm/llvm-project.git
$ cd llvm-project
$ mkdir build
$ cd build
$ cmake -GNinja -DCMAKE_BUILD_TYPE=Debug \
    -DLLVM_ENABLE_PROJECTS='clang;lld;clang-tools-extra' \
    -DCMAKE_EXPORT_COMPILE_COMMANDS=On -DLLVM_ENABLE_LLD=On \
    -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ ../llvm
$ ninja
$ parallel clang-tidy -checks='-*,bugprone-argument-comment' \
    -config='{CheckOptions: [{key: StrictMode, value: 1}]}' -fix \
    ::: ../llvm/lib/**/*.{cpp,h} ../clang/lib/**/*.{cpp,h} ../lld/**/*.{cpp,h}

llvm-svn: 366177
2019-07-16 04:46:31 +00:00
Fangrui Song 90e95bb289 Delete dead stores
llvm-svn: 365901
2019-07-12 14:04:34 +00:00
Csaba Dabis e856c0465d [analyzer] CastValueChecker: Remove a dump()
Summary: Fix a nit.
llvm-svn: 365590
2019-07-10 00:50:01 +00:00