86 Commits

Author SHA1 Message Date
Ted Kremenek
7cf8238291 Remove some stale ErrorNodes variables in GRExprEngine and the old buffer overflow logic in GRExprEngineInternalChecks.cpp.
llvm-svn: 86877
2009-11-11 20:16:36 +00:00
Zhongxing Xu
b166712d02 Add undefined array subscript checker.
llvm-svn: 86837
2009-11-11 13:42:54 +00:00
Zhongxing Xu
4f7759a339 Reimplement out-of-bound array access checker with the new checker interface.
Now only one test case is XFAIL'ed.

llvm-svn: 86834
2009-11-11 12:33:27 +00:00
Ted Kremenek
4325315935 Remove public headers for UndefinedArgChecker, AttrNonNullChecker, and BadCallChecker, making their implementations completely private.
llvm-svn: 86809
2009-11-11 05:50:44 +00:00
Ted Kremenek
5e1f78aeb1 Refactor DereferenceChecker to use only the new Checker API instead of
the old builder API.  This percolated a bunch of changes up to the
Checker class (where CheckLocation has been renamed VisitLocation) and
GRExprEngine.  ProgramPoint now has the notion of a "LocationCheck"
point (with PreLoad and PreStore respectively), and a bunch of the old
ProgramPoints that are no longer used have been removed.

llvm-svn: 86798
2009-11-11 03:26:34 +00:00
Zhongxing Xu
ab0e27ff0c Add check for pointer arithmetic on non-array variables.
llvm-svn: 86538
2009-11-09 13:23:31 +00:00
Zhongxing Xu
f06c684a33 Add checker for CWE-588: Attempt to Access Child of a Non-structure Pointer.
llvm-svn: 86529
2009-11-09 08:07:38 +00:00
Zhongxing Xu
6c306c8b89 Add checker for CWE-587: Assignment of a Fixed Address to a Pointer.
llvm-svn: 86523
2009-11-09 06:52:44 +00:00
Zhongxing Xu
86b1e01c13 Add checker for CWE-469: Use of Pointer Subtraction to Determine Size. This
checker does not build sink nodes. Because svaluator computes an unknown value
for the subtraction now.

llvm-svn: 86517
2009-11-09 05:34:10 +00:00
Ted Kremenek
795c611cfa Make the VLASizeChecker implementation private, and its creation only known to GRExprEngineInternalChecks.cpp.
llvm-svn: 86292
2009-11-06 21:51:50 +00:00
Ted Kremenek
53a70c055d Make the implementation of DivZeroChecker private.
llvm-svn: 86288
2009-11-06 20:47:51 +00:00
Zhongxing Xu
167bce9cf1 Add a checker for CWE-466: Return of Pointer Value Outside of Expected Range.
llvm-svn: 86252
2009-11-06 13:30:44 +00:00
Ted Kremenek
bee01e5b61 static analyzer: refactor checking logic for returning the address of a stack variable or a garbage
value into their own respective subclasses of Checker (and put them in .cpp files where their
implementation details are hidden from GRExprEngine).

llvm-svn: 86215
2009-11-06 02:24:13 +00:00
Ted Kremenek
ef910047b2 Catch uses of undefined values when they are used in assignment, thus catching such bugs closer to the source.
llvm-svn: 86003
2009-11-04 04:24:16 +00:00
Zhongxing Xu
259d46407a Merge ZeroSizedVLAChecker and UndefSizedVLAChecker.
llvm-svn: 85996
2009-11-04 01:43:07 +00:00
Ted Kremenek
8d43a6ac3d Merge NullDerefChecker.[h,cpp] and UndefDerefChecker.[h,cpp]. They are essentially two parts of the same check.
llvm-svn: 85911
2009-11-03 18:41:06 +00:00
Zhongxing Xu
27fee83ec4 Pull VLA size checker into its own files.
Split it to two checkers, one for undefined size, 
the other for zero size, so that we don't need to query the size
when emitting the bug report.

llvm-svn: 85895
2009-11-03 12:13:38 +00:00
Zhongxing Xu
9b9d731a8b Pull AttrNonNullChecker into its own files.
llvm-svn: 85883
2009-11-03 07:35:33 +00:00
Zhongxing Xu
ab162e1873 Pull UndefinedArgChecker into its own files.
llvm-svn: 85875
2009-11-03 06:46:03 +00:00
Zhongxing Xu
0deca3486e Pull BadCallChecker into its own files.
llvm-svn: 85868
2009-11-03 05:48:04 +00:00
Zhongxing Xu
b1c24724dd Move CheckDivZero into its own files.
llvm-svn: 85651
2009-10-31 10:02:37 +00:00
Zhongxing Xu
358ced08d0 Move UndefDerefChecker into its own file.
llvm-svn: 85645
2009-10-31 08:44:33 +00:00
Ted Kremenek
89f5c189db Move NullDerefChecker.h instead a 'Checkers' subdirectory.
llvm-svn: 85596
2009-10-30 17:28:40 +00:00
Ted Kremenek
f613e89617 Move all logic for the null dereference checker from GRExprEngineInternalChecks.cpp to a separate .cpp file.
llvm-svn: 85595
2009-10-30 17:24:47 +00:00
Ted Kremenek
1dbdbcc04c Fix accidental use of CheckSVal instead of CheckLocation, and add a
small test case to show we handle dereferences of undefined values.

llvm-svn: 85492
2009-10-29 05:33:39 +00:00
Zhongxing Xu
6b8bfb376b Move NullDeref and UndefDeref into their own checker.
Add a CheckLocation() interface to Checker.
Now ImplicitNullDeref nodes are cached in NullDerefChecker.
More cleanups follow.

llvm-svn: 85471
2009-10-29 02:09:30 +00:00
Zhongxing Xu
4611aee0ac Rename: CheckBadDiv->CheckDivZero.
llvm-svn: 84824
2009-10-22 01:58:10 +00:00
Ted Kremenek
d9120d3575 Shorten the static analyzer diagnostic for 'use of garbage value'.
llvm-svn: 82672
2009-09-24 00:44:26 +00:00
Ted Kremenek
4f335c300a Have divide-by-zero checker not handled undefined denominators. This is handled by the generic checking for undefined operands for BinaryOperators.
llvm-svn: 82019
2009-09-16 06:04:26 +00:00
Ted Kremenek
188f62f1cc Fix static analyzer regression when emitting undefined value warnings
with binary operators.  The result of a binary operator may be
undefined even if its operands are well-defined.

llvm-svn: 81874
2009-09-15 17:43:54 +00:00
Ted Kremenek
7020eae076 Introduce "DefinedOrUnknownSVal" into the SVal class hierarchy, providing a way
to statically type various methods in SValuator/GRState as required either a
defined value or a defined-but-possibly-unknown value. This leads to various
logic cleanups in GRExprEngine, and lets the compiler enforce via type checking
our assumptions about what symbolic values are possibly undefined and what are
not.

Along the way, clean up some of the static analyzer diagnostics regarding the uses of uninitialized values.

llvm-svn: 81579
2009-09-11 22:07:28 +00:00
Mike Stump
11289f4280 Remove tabs, and whitespace cleanups.
llvm-svn: 81346
2009-09-09 15:08:12 +00:00
Ted Kremenek
b117fd9168 Fix regression introduced in r80786 and reported in PR 4867. We should use
'dyn_cast' instead of 'cast' as the denominator value could be UnknownVal (and
is not guaranteed to be a DefinedVal).

llvm-svn: 80869
2009-09-03 01:48:03 +00:00
Zhongxing Xu
677e6a2faf remove a debug output I introduced in the last commit.
llvm-svn: 80865
2009-09-03 01:31:59 +00:00
Zhongxing Xu
6e4232c79c Refactor the check for bad divide into a checker.
Also fix a checker context bug: the Dst set is not always empty initially. 
Because in GRExprEngine::CheckerVisit(), *CurrSet is used repeatedly. 
So we removed the Dst.empty() condition in ~CheckerContext() when deciding
whether to do autotransision.

llvm-svn: 80786
2009-09-02 13:26:26 +00:00
Zhongxing Xu
79affb7b94 Refactor bad callee check into a Checker.
Now bad callee is checked as a PreVisit to the CallExpr.

llvm-svn: 80771
2009-09-02 08:10:35 +00:00
Zhongxing Xu
656b10a1fa Still use BadArg bugtype in the checker. This saves us implement registerInitialVisitors
in the BugReport. 

When all internal bug checking logic are moved to checkers, BuiltinBug will
not reference GRExprEngine, and FlushReports() will be not necessary, since
all bugs are emitted into the equivalent classes immediately.

For now just add a ctor with no arguments.

llvm-svn: 80770
2009-09-02 07:09:39 +00:00
Ted Kremenek
3aff920676 Sentence-case bug category.
llvm-svn: 80644
2009-09-01 00:17:12 +00:00
Zhongxing Xu
6fd66d4588 Refactor undefined argument checking into a Checker.
llvm-svn: 80417
2009-08-29 02:11:01 +00:00
Ted Kremenek
d6cfbafd3b ConstraintManager::AssumeDual now accepts a 'DefinedSVal' instead of 'SVal' for
the condition. This eliminates a source of bugs where the client doesn't
correctly reason about undefined or unknown values. This fixes PR 4759.

llvm-svn: 79952
2009-08-24 22:47:34 +00:00
Ted Kremenek
9b2c79de59 Enhance static analyzer diagnostics by introducing a new 'EnhancedBugReporter'
which allows custom checks to register callback creator functions for creating
BugReporterVisitor objects. This allows various checks to include diagnostics
such as 'assuming value is null' with little extra work. Eventually this API
should be refactored to be cleaner and more simple.

llvm-svn: 79302
2009-08-18 01:05:30 +00:00
Zhongxing Xu
107f75989c Last step of template cleanup: merge *BuilderImpl to *Builder.
Some Builders need further cleanup.

llvm-svn: 78301
2009-08-06 12:48:26 +00:00
Zhongxing Xu
20227f71d7 As GRState seems general enough, it is time to merge some template classes
and their impl base classes. This can greatly simply some code of the core 
analysis engine. This patch merges ExplodedNodeImpl into ExplodedNode.

llvm-svn: 78270
2009-08-06 01:32:16 +00:00
Ted Kremenek
faf0c64d9d Fix regression in attribute 'nonnull' checking when a transition node
was created but not added to the destination NodeSet.  This fixes PR 4630.

llvm-svn: 77353
2009-07-28 19:24:31 +00:00
Ted Kremenek
745088c49e Mark destructor of Checker virtual.
llvm-svn: 76924
2009-07-24 00:40:31 +00:00
Ted Kremenek
bfd28fd596 Refactor 'PostStmt' and 'PreStmt' to subclass a common parent 'StmtPoint'.
Educate GRExprEngine::VisitGraph() about 'PreStmt'.

Mark the constructor of 'PostStmt' to be explicit, preventing implicit
conversions and the selection of the wrong 'generateNode' method in
GRStmtNodeBuilder.

Constify a bunch of arguments, which falls out of the changes to ProgramPoint.

llvm-svn: 76809
2009-07-22 22:35:28 +00:00
Ted Kremenek
915c351496 Migrate the path-sensitive checking of 'nonnull' arguments over to the new
'Checker' interface. An updated test case illustrates that after calling a
function with the 'nonnull' attribute we now register the fact that the passed
pointer must be non-null. This retention of information was not possible with
the previously used GRSimpleAPICheck interface.

llvm-svn: 76797
2009-07-22 21:46:56 +00:00
Ted Kremenek
f1282074c3 Move bug reporter "visitors" to their own file and make them part of the public
BugReporter API.  No real functionality change.

llvm-svn: 76760
2009-07-22 17:55:28 +00:00
Steve Naroff
79d1215d83 Remove ASTContext::isObjCObjectPointerType().
Convert all clients to use the new predicate on Type.

llvm-svn: 76076
2009-07-16 15:41:00 +00:00
Argyrios Kyrtzidis
b4b64ca752 Remove the ASTContext parameter from the attribute-related methods of Decl.
The implementations of these methods can Use Decl::getASTContext() to get the ASTContext.

This commit touches a lot of files since call sites for these methods are everywhere.
I used pre-tokenized "carbon.h" and "cocoa.h" headers to do some timings, and there was no real time difference between before the commit and after it.

llvm-svn: 74501
2009-06-30 02:34:44 +00:00