| 651f13cea278ec967336033dd032faef0e9fc2ec |
|
24-Apr-2014 |
Stephen Hines <srhines@google.com> |
Updated to Clang 3.5a.
Change-Id: I8127eb568f674c2e72635b639a3295381fe8af82
/external/clang/test/Analysis/malloc.c
|
| 6df32e24975ab457fa4b428326076436e48dad06 |
|
09-Dec-2013 |
Bill Wendling <isanbard@gmail.com> |
Merging r196599:
------------------------------------------------------------------------
r196599 | zaks | 2013-12-06 11:28:16 -0800 (Fri, 06 Dec 2013) | 5 lines
Fixup to r196593.
This is another regression fixed by reverting r189090.
In this case, the problem is not live variables but the approach that was taken in r189090. This regression was caused by explicitly binding "true" to the condition when we take the true branch. Normally that's okay, but in this case we're planning to reuse that condition as the value of the expression.
------------------------------------------------------------------------
git-svn-id: https://llvm.org/svn/llvm-project/cfe/branches/release_34@196796 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| b7a747b0c271faeeb8d0f886f0e691eb25f637d9 |
|
17-Nov-2013 |
Anton Yartsev <anton.yartsev@gmail.com> |
[analyzer] Better modeling of memcpy by the CStringChecker (PR16731).
New rules of invalidation/escape of the source buffer of memcpy: the source buffer contents is invalidated and escape while the source buffer region itself is neither invalidated, nor escape.
In the current modeling of memcpy the information about allocation state of regions, accessible through the source buffer, is not copied to the destination buffer and we can not track the allocation state of those regions anymore. So we invalidate/escape the source buffer indirect regions in anticipation of their being invalidated for real later. This eliminates false-positive leaks reported by the unix.Malloc and alpha.cplusplus.NewDeleteLeaks checkers for the cases like
char *f() {
void *x = malloc(47);
char *a;
memcpy(&a, &x, sizeof a);
return a;
}
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@194953 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| a728e927c6e58f26b2c8615a8baa761d2f157e4b |
|
19-Aug-2013 |
Jordan Rose <jordan_rose@apple.com> |
[analyzer] Assume that strings are no longer than SIZE_MAX/4.
This keeps the analyzer from making silly assumptions, like thinking
strlen(foo)+1 could wrap around to 0. This fixes PR16558.
Patch by Karthik Bhat!
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@188680 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 68502e52938f84b97267b51e86d4a90a11552512 |
|
15-Aug-2013 |
Jordan Rose <jordan_rose@apple.com> |
[analyzer] If realloc fails on an escaped region, that region doesn't leak.
When a region is realloc()ed, MallocChecker records whether it was known
to be allocated or not. If it is, and the reallocation fails, the original
region has to be freed. Previously, when an allocated region escaped,
MallocChecker completely stopped tracking it, so a failed reallocation
still (correctly) wouldn't require freeing the original region. Recently,
however, MallocChecker started tracking escaped symbols, so that if it were
freed we could check that the deallocator matched the allocator. This
broke the reallocation model for whether or not a symbol was allocated.
Now, MallocChecker will actually check if a symbol is owned, and only
require freeing after a failed reallocation if it was owned before.
PR16730
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@188468 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 374ae320b87c15b0262c40e5c46e8990111df5ca |
|
10-May-2013 |
Jordan Rose <jordan_rose@apple.com> |
[analyzer] Indirect invalidation counts as an escape for leak checkers.
Consider this example:
char *p = malloc(sizeof(char));
systemFunction(&p);
free(p);
In this case, when we call systemFunction, we know (because it's a system
function) that it won't free 'p'. However, we /don't/ know whether or not
it will /change/ 'p', so the analyzer is forced to invalidate 'p', wiping
out any bindings it contains. But now the malloc'd region looks like a
leak, since there are no more bindings pointing to it, and we'll get a
spurious leak warning.
The fix for this is to notice when something is becoming inaccessible due
to invalidation (i.e. an imperfect model, as opposed to being explicitly
overwritten) and stop tracking it at that point. Currently, the best way
to determine this for a call is the "indirect escape" pointer-escape kind.
In practice, all the patch does is take the "system functions don't free
memory" special case and limit it to direct parameters, i.e. just the
arguments to a call and not other regions accessible to them. This is a
conservative change that should only cause us to escape regions more
eagerly, which means fewer leak warnings.
This isn't perfect for several reasons, the main one being that this
example is treated the same as the one above:
char **p = malloc(sizeof(char *));
systemFunction(p + 1);
// leak
Currently, "addresses accessible by offsets of the starting region" and
"addresses accessible through bindings of the starting region" are both
considered "indirect" regions, hence this uniform treatment.
Another issue is our longstanding problem of not distinguishing const and
non-const bindings; if in the first example systemFunction's parameter were
a char * const *, we should know that the function will not overwrite 'p',
and thus we can safely report the leak.
<rdar://problem/13758386>
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@181607 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 0413023bed8ec91d3642cd6ff114957badf51f31 |
|
09-Apr-2013 |
Anna Zaks <ganna@apple.com> |
[analyzer] Keep tracking the pointer after the escape to more aggressively report mismatched deallocator
Test that the path notes do not change. I don’t think we should print a note on escape.
Also, I’ve removed a check that assumed that the family stored in the RefStete could be
AF_None and added an assert in the constructor.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@179075 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 68eb4c25e961d18f82b47a0a385f90d7af09bcc3 |
|
06-Apr-2013 |
Anna Zaks <ganna@apple.com> |
[analyzer] Shorten the malloc checker’s leak message
As per Ted’s suggestion!
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@178938 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 74f6982232c25ae723b1cc5abc59665a10867f21 |
|
20-Mar-2013 |
Jordan Rose <jordan_rose@apple.com> |
[analyzer] Track malloc'd memory into struct fields.
Due to improper modelling of copy constructors (specifically, their
const reference arguments), we were producing spurious leak warnings
for allocated memory stored in structs. In order to silence this, we
decided to consider storing into a struct to be the same as escaping.
However, the previous commit has fixed this issue and we can now properly
distinguish leaked memory that happens to be in a struct from a buffer
that escapes within a struct wrapper.
Originally applied in r161511, reverted in r174468.
<rdar://problem/12945937>
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@177571 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 74c0d6988462c2cb882e7a8b8050fe119a5af56f |
|
16-Mar-2013 |
Anna Zaks <ganna@apple.com> |
[analyzer] Use isLiveRegion to determine when SymbolRegionValue is dead.
Fixes a FIXME, improves dead symbol collection, suppresses a false positive,
which resulted from reusing the same symbol twice for simulation of 2 calls to the same function.
Fixing this lead to 2 possible false negatives in CString checker. Since the checker is still alpha and
the solution will not require revert of this commit, move the tests to a FIXME section.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@177206 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 118aa750c5cfe975542dce8e41586b2054d1f5dd |
|
08-Feb-2013 |
Anna Zaks <ganna@apple.com> |
[analyzer] Report bugs when freeing memory with offset pointer
The malloc checker will now catch the case when a previously malloc'ed
region is freed, but the pointer passed to free does not point to the
start of the allocated memory. For example:
int *p1 = malloc(sizeof(int));
p1++;
free(p1); // warn
From the "memory.LeakPtrValChanged enhancement to unix.Malloc" entry
in the list of potential checkers.
A patch by Branden Archer!
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@174678 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 233e26acc0ff2a1098f4c813f69286fce840a422 |
|
08-Feb-2013 |
Anna Zaks <ganna@apple.com> |
[analyzer] Add pointer escape type param to checkPointerEscape callback
The checkPointerEscape callback previously did not specify how a
pointer escaped. This change includes an enum which describes the
different ways a pointer may escape. This enum is passed to the
checkPointerEscape callback when a pointer escapes. If the escape
is due to a function call, the call is passed. This changes
previous behavior where the call is passed as NULL if the escape
was due to indirectly invalidating the region the pointer referenced.
A patch by Branden Archer!
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@174677 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| b98c6fe8877b809d4da3020692c9b38f972b92cf |
|
06-Feb-2013 |
Anna Zaks <ganna@apple.com> |
[analyzer]Revert part of r161511; suppresses leak false positives in C++
This is a "quick fix".
The underlining issue is that when a const pointer to a struct is passed
into a function, we do not invalidate the pointer fields. This results
in false positives that are common in C++ (since copy constructors are
prevalent). (Silences two llvm false positives.)
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@174468 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 6e99f9f56f320818d814a5474d76a2849e037c55 |
|
27-Nov-2012 |
Jordan Rose <jordan_rose@apple.com> |
[analyzer] Fix test to work on non-LP64 systems.
Thanks for the original catch in r168303, Takumi.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@168671 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 7a29070e01c1b48f85b7d3fced5315db8958fae2 |
|
19-Nov-2012 |
NAKAMURA Takumi <geek4civic@gmail.com> |
clang/test: Suppress two tests on LLP64 target, Windows x64.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@168303 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 63bc186d6ac0b44ba4ec6fccb5f471b05c79b666 |
|
15-Nov-2012 |
Jordan Rose <jordan_rose@apple.com> |
[analyzer] Report leaks at the closing brace of a function body.
This fixes a few cases where we'd emit path notes like this:
+---+
1| v
p = malloc(len);
^ |2
+---+
In general this should make path notes more consistent and more correct,
especially in cases where the leak happens on the false branch of an if
that jumps directly to the end of the function. There are a couple places
where the leak is reported farther away from the cause; these are usually
cases where there are several levels of nested braces before the end of
the function. This still matches our current behavior for when there /is/
a statement after all the braces, though.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@168070 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 84c484545c5906ba55143e212b4a5275ab55889f |
|
15-Nov-2012 |
Jordan Rose <jordan_rose@apple.com> |
[analyzer] Mark symbol values as dead in the environment.
This allows us to properly remove dead bindings at the end of the top-level
stack frame, using the ReturnStmt, if there is one, to keep the return value
live. This in turn removes the need for a check::EndPath callback in leak
checkers.
This does cause some changes in the path notes for leak checkers. Previously,
a leak would be reported at the location of the closing brace in a function.
Now, it gets reported at the last statement. This matches the way leaks are
currently reported for inlined functions, but is less than ideal for both.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@168066 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 9dc298bf8e4001978e44e7f1872f337fe5805960 |
|
13-Sep-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Fix another false positive in malloc realloc logic.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163749 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 1b22cec353bc6112653d50b060a1d78d70c51527 |
|
12-Sep-2012 |
Chandler Carruth <chandlerc@gmail.com> |
Adjust some analyzer tests to place widely shared inputs inside of an
'Inputs' subdirectory.
The general desire has been to have essentially all of the non-test
input files live in such directories, with some exceptions for obvious
and common patterns like 'foo.c' using 'foo.h'.
This came up because our distributed test runner couldn't find some of
the headers, for example with stl.cpp.
No functionality changed, just shuffling around here.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@163674 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| cdc3a89d5de90b2299c56f4a46c3de590c5184d1 |
|
24-Aug-2012 |
Ted Kremenek <kremenek@apple.com> |
Fix analyzer tests.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162588 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 55dd956d521d4d650dfd929d67f4b98ede61c0ea |
|
24-Aug-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Fix realloc related bug in the malloc checker.
When reallocation of a non-allocated (not owned) symbol fails do not
expect it to be freed.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162533 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| c4bac8e376b98d633bb00ee5f510d5e58449753c |
|
16-Aug-2012 |
Ted Kremenek <kremenek@apple.com> |
Allow multiple PathDiagnosticConsumers to be used with a BugReporter at the same time.
This fixes several issues:
- removes egregious hack where PlistDiagnosticConsumer would forward to HTMLDiagnosticConsumer,
but diagnostics wouldn't be generated consistently in the same way if PlistDiagnosticConsumer
was used by itself.
- emitting diagnostics to the terminal (using clang's diagnostic machinery) is no longer a special
case, just another PathDiagnosticConsumer. This also magically resolved some duplicate warnings,
as we now use PathDiagnosticConsumer's diagnostic pruning, which has scope for the entire translation
unit, not just the scope of a BugReporter (which is limited to a particular ExprEngine).
As an interesting side-effect, diagnostics emitted to the terminal also have their trailing "." stripped,
just like with diagnostics emitted to plists and HTML. This required some tests to be updated, but now
the tests have higher fidelity with what users will see.
There are some inefficiencies in this patch. We currently generate the report graph (from the ExplodedGraph)
once per PathDiagnosticConsumer, which is a bit wasteful, but that could be pulled up higher in the
logic stack. There is some intended duplication, however, as we now generate different PathDiagnostics (for the same issue)
for different PathDiagnosticConsumers. This is necessary to produce the diagnostics that a particular
consumer expects.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@162028 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 919e8a1c6698bfa6848571d366430126bced727d |
|
08-Aug-2012 |
Jordan Rose <jordan_rose@apple.com> |
[analyzer] Clean up the printing of FieldRegions for leaks.
Unfortunately, generalized region printing is very difficult:
- ElementRegions are used both for casting and as actual elements.
- Accessing values through a pointer means going through an intermediate
SymbolRegionValue; symbolic regions are untyped.
- Referring to implicitly-defined variables like 'this' and 'self' could be
very confusing if they come from another stack frame.
We fall back to simply not printing the region name if we can't be sure it
will print well. This will allow us to improve in the future.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161512 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 0d53ab4024488d0c6cd283992be3fd4b67099bd3 |
|
08-Aug-2012 |
Jordan Rose <jordan_rose@apple.com> |
[analyzer] Track malloc'd regions stored in structs.
The main blocker on this (besides the previous commit) was that
ScanReachableSymbols was not looking through LazyCompoundVals.
Once that was fixed, it's easy enough to clear out malloc data on return,
just like we do when we bind to a global region.
<rdar://problem/10872635>
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161511 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 4d33286d59e5d71a072c7e08ea0c5dd65e45b81c |
|
04-Aug-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Malloc: remove assert since is not valid as of r161248
We can be in the situation where we did not track the symbol before
realloc was called on it.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161294 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| ede875b794e8f35aa1432e61610ea6e84360b6d3 |
|
03-Aug-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Malloc: track non-allocated but freed memory
There is no reason why we should not track the memory which was not
allocated in the current function, but was freed there. This would
allow to catch more use-after-free and double free with no/limited IPA.
Also fix a realloc issue which surfaced as the result of this patch.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@161248 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 85d7e01cf639b257d70f8a129709a2d7594d7b22 |
|
02-Jul-2012 |
Jordan Rose <jordan_rose@apple.com> |
[analyzer] Move the last bits of CallOrObjCMessage over to CallEvent.
This involved refactoring some common pointer-escapes code onto CallEvent,
then having MallocChecker use those callbacks for whether or not to consider
a pointer's /ownership/ as escaping. This still needs to be pinned down, and
probably we want to make the new argumentsMayEscape() function a little more
discerning (content invalidation vs. ownership/metadata invalidation), but
this is a good improvement.
As a bonus, also remove CallOrObjCMessage from the source completely.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@159557 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 52a04812e5767dab68efb33ad044760b5b168941 |
|
21-Jun-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Malloc leak false positive: Allow xpc context to escape.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158875 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 1bf908df57cc43f3bc7296f4e51f5708bd323c6b |
|
16-Jun-2012 |
Jordan Rose <jordan_rose@apple.com> |
[analyzer] Buffers passed to CGBitmapContextCreate can escape.
Specifically, although the bitmap context does not take ownership of the
buffer (unlike CGBitmapContextCreateWithData), the data buffer can be extracted
out of the created CGContextRef. Thus the buffer is not leaked even if its
original pointer goes out of scope, as long as
- the context escapes, or
- it is retrieved via CGBitmapContextGetData and freed.
Actually implementing that logic is beyond the current scope of MallocChecker,
so for now CGBitmapContextCreate goes on our system function exception list.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158579 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| adccc3f088784423ec8048b00dc2e76140e0c3f1 |
|
08-Jun-2012 |
Anna Zaks <ganna@apple.com> |
[analyze] Change some of the malloc tests to use clang_analyzer_eval.
Thanks, Jordan.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158179 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 783f0087ecb5af27d2f8caed7d6b904797c3d752 |
|
07-Jun-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Fixit for r158136.
I falsely assumed that the memory spaces are equal when we reach this
point, they might not be when memory space of one or more is stack or
Unknown. We don't want a region from Heap space alias something with
another memory space.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158165 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| e17fdb2d5dbf0ffefd417587003eebbe5baf5984 |
|
07-Jun-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Anti-aliasing: different heap allocations do not alias
Add a concept of symbolic memory region belonging to heap memory space.
When comparing symbolic regions allocated on the heap, assume that they
do not alias.
Use symbolic heap region to suppress a common false positive pattern in
the malloc checker, in code that relies on malloc not returning the
memory aliased to other malloc allocations, stack.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@158136 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 1434518f17272968765602a54391c794c975350a |
|
18-May-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer]Malloc: refactor and report use after free by memory
allocating functions.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@157037 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 84d43848e39eab9e3386cbfb3906ba2d6a382f24 |
|
04-May-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer]Fixup r156134: Handle the case when FunctionDecl isn't avail.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156183 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| b79d862af66d8dd9d059863813b9a27d744bd990 |
|
04-May-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Assume pointer escapes when a callback is passed inside
a struct.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156135 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| aca0ac58d2ae80d764e3832456667d7322445e0c |
|
04-May-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Allow pointers escape through calls containing callback args.
(Since we don't have a generic pointer escape callback, modify
ExprEngineCallAndReturn as well as the malloc checker.)
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156134 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| e55a14a025c38800d07f1ab0db7dbbe4a2fe1605 |
|
03-May-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Conjure a symbol to ensure we can identify pointer arithmetic
We need to identify the value of ptr as
ElementRegion (result of pointer arithmetic) in the following code.
However, before this commit '(2-x)' evaluated to Unknown value, and as
the result, 'p + (2-x)' evaluated to Unknown value as well.
int *p = malloc(sizeof(int));
ptr = p + (2-x);
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156052 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 31595e22b7e0d21b0b7c4c4fb196e97d3edc2a08 |
|
03-May-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Revert the functional part of r155944.
The change resulted in multiple issues on the buildbot, so it's not
ready for prime time. Only enable history tracking for tainted
data(which is experimental) for now.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@156049 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 93c5a24b517e65eb61481ed866b503f1e37cff20 |
|
02-May-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Fix the 'ptr = ptr' false negative in the Malloc checker.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155963 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 140d0c64417e2fb5fc4dd40ce0d46b037ac11b02 |
|
01-May-2012 |
Ted Kremenek <kremenek@apple.com> |
Teach SValBuilder to handle casts of symbolic pointer values to an integer twice. Fixes <rdar://problem/11212866>.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155950 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 33e4a1d3f061a2b8549fbfbf2d15a396cc395dca |
|
01-May-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Test case reported for a reported false positive, now fixed.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155945 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| e2241cbb0455a60ba27d6c4b9d601ffef3ed103f |
|
01-May-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Construct a SymExpr even when the constraint solver cannot
reason about the expression.
This essentially keeps more history about how symbolic values were
constructed. As an optimization, previous to this commit, we only kept
the history if one of the symbols was tainted, but it's valuable keep
the history around for other purposes as well: it allows us to avoid
constructing conjured symbols.
Specifically, we need to identify the value of ptr as
ElementRegion (result of pointer arithmetic) in the following code.
However, before this commit '(2-x)' evaluated to Unknown value, and as
the result, 'p + (2-x)' evaluated to Unknown value as well.
int *p = malloc(sizeof(int));
ptr = p + (2-x);
This change brings 2% slowdown on sqlite. Fixes radar://11329382.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155944 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 8f40afbf7740c39fccaa4b8cc5aa2814d5ed6fdc |
|
26-Apr-2012 |
Ted Kremenek <kremenek@apple.com> |
[analyzer] check lazy bindings in RegionStore first before looking for default values. Fixes <rdar://problem/11269741>.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@155615 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 3d7c44e01d568e5d5c0fac9c6ccb3f080157ba19 |
|
21-Mar-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Malloc: Utter the name of the leaked variable.
Specifically, we use the last store of the leaked symbol in the leak diagnostic.
(No support for struct fields since the malloc checker doesn't track those
yet.)
+ Infrastructure to track the regions used in store evaluations.
This approach is more precise than iterating the store to
obtain the region bound to the symbol, which is used in RetainCount
checker. The region corresponds to what is uttered in the code in the
last store and we do not rely on the store implementation to support
this functionality.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@153212 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| a99f874bf2ade1e32f0feda7d5b8211171440f02 |
|
06-Mar-2012 |
Ted Kremenek <kremenek@apple.com> |
Teach SimpleSValBuilder that (in the absence of more information) stack memory doesn't alias symbolic memory. This is a heuristic/hack, but works well in practice. Fixes <rdar://problem/10978247>.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@152065 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| ca23eb212c78ac5bc62d0881635579dbe7095639 |
|
29-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Malloc: A pointer might escape through CFContainers APIs,
funopen, setvbuf.
Teach the checker and the engine about these APIs to resolve malloc
false positives. As I am adding more of these APIs, it is clear that all
this should be factored out into a separate callback (for example,
region escapes). Malloc, KeyChainAPI and RetainRelease checkers could
all use it.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151737 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| ca8e36eb637e232475ef31c3f22d5da907390917 |
|
23-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Malloc: unique leak reports by allocation site.
When we find two leak reports with the same allocation site, report only
one of them.
Provide a helper method to BugReporter to facilitate this.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151287 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 0d389b819c33bdf0375694a8f141c8f02e002b18 |
|
23-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Invalidate the region passed to pthread_setspecific() call.
Make this call an exception in ExprEngine::invalidateArguments:
'int pthread_setspecific(ptheread_key k, const void *)' stores
a value into thread local storage. The value can later be retrieved
with 'void *ptheread_getspecific(pthread_key)'. So even thought the
parameter is 'const void *', the region escapes through the
call.
(Here we just blacklist the call in the ExprEngine's default
logic. Another option would be to add a checker which evaluates
the call and triggers the call to invalidate regions.)
Teach the Malloc Checker, which treats all system calls as safe about
the API.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151220 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 87cb5bed5060805a86509c297fae133816c1cd87 |
|
22-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Malloc cleanup:
- We should not evaluate strdup in the Malloc Checker, it's the job of
CString checker, so just update the RefState to reflect allocated
memory.
- Refactor to reduce LOC: remove some wrapper auxiliary functions, make
all functions return the state and add the transition in one place
(instead of in each auxiliary function).
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151188 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 60a1fa497b978114b969f4f0176a7cbad3b5d9c6 |
|
22-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Malloc checker: mark 'strdup' and 'strndup' as allocators.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151124 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| d9ab7bbbd43639247c9a82c8e8dbfaa617f4e266 |
|
22-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Malloc: fix another false positive.
, when we return a symbol reachable to the malloced one via pointer
arithmetic.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@151121 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| bb2a6864f111e13f7905725963649c60c60bf18b |
|
20-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Turn on by default the Malloc Checker and a couple of CString
checks:
- unix.Malloc - Checks for memory leaks, double free, use-after-free.
- unix.cstring.NullArg - Checks for null pointers passed as arguments to
CString functions + evaluates CString functions.
- unix.cstring.BadSizeArg - Checks for common anti-patterns in
strncat size argument.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150988 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| d8a8a3b6ad7c786dfcf341b080bd19b5d4b84b5b |
|
17-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Malloc Checker more tests.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150847 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| f0dfc9c0f29fd82552896558c04043731d30b851 |
|
17-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Fix another false positive in the Malloc Checker, by making
it aware of CString APIs that return the input parameter.
Malloc Checker needs to know how the 'strcpy' function is
evaluated. Introduce the dependency on CStringChecker for that.
CStringChecker knows all about these APIs.
Addresses radar://10864450
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150846 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| ad901a6cf3c57d7dd3d7b400835440992e99cff8 |
|
16-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] MallocChecker: more tests.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150734 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| febdc324faaf1678a4f41497fd691efe54e145c9 |
|
16-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Malloc Checker: Clean up bug naming:
- Rename the category "Logic Error" -> "Memory Error".
- Shorten all the messages.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150733 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| ac593008c2035fa241c80352a0c97c5d853facbf |
|
16-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Malloc Checker: Give up when a pointer escapes into a struct.
We are not properly handling the memory regions that escape into struct
fields, which led to a bunch of false positives. Be conservative here
and give up when a pointer escapes into a struct.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150658 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| ebc1d3261e42f45d693fffef5a01a570ef2e89cf |
|
15-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Malloc Checker: Add another false positive as a todo test.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150534 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 40add2983dedcf489d7ad8c7bccc58b6ae368ee4 |
|
15-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Malloc Checker: add support for reallocf, which always frees
the passed in pointer on failure.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150533 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| b16ce45bd05b637b3d7b0bf70c05e5dfd4ddacc7 |
|
15-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Malloc Checker: add support for valloc + minor code
hardening.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150532 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| b276bd9cc98247331cac8b290ba278b939e53657 |
|
14-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Malloc Checker: realloc: add dependency between the symbols
in realloc map.
If there is no dependency, the reallocated ptr will get garbage
collected before we know that realloc failed, which would lead us to
missing a memory leak warning.
Also added new test cases, which we can handle now.
Plus minor cleanups.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150446 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 30838b994527d12e269abb14d395b1878e78c16d |
|
13-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Malloc Checker: realloc: correct the way we are handing the
case when size is 0.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150412 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| c8bb3befcad8cd8fc9556bc265289b07dc3c94c8 |
|
13-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Malloc checker: rework realloc handling:
1) Support the case when realloc fails to reduce False Positives. (We
essentially need to restore the state of the pointer being reallocated.)
2) Realloc behaves differently under special conditions (from pointer is
null, size is 0). When detecting these cases, we should consider
under-constrained states (size might or might not be 0). The
old version handled this in a very hacky way. The code did not
differentiate between definite and possible (no consideration for
under-constrained states). Further, after processing each special case,
the realloc processing function did not return but chained to the next
special case processing. So you could end up in an execution in which
you first see the states in which size is 0 and realloc ~ free(),
followed by the states corresponding to size is not 0 followed by the
evaluation of the regular realloc behavior.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150402 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 15d0ae170c2037815b6383c532253585fcd3d04e |
|
12-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Malloc Checker: reduce false negatives rate by assuming that
a pointer cannot escape through calls to system functions. Also, stop
after reporting the first use-after-free.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150315 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 0860cd0646ed40f87085df39563f2c5f7f77750b |
|
11-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Malloc Checker: Report a leak when we are returning freed
memory.
(As per one test case, the existing checker thought that this could
cause a lot of false positives - not sure if that's valid, to be
verified.)
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150313 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| da04677092c7b08fe7438f82a8636dcc8c6e9683 |
|
11-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Malloc checker: Leak bugs should be suppressed by sinks.
Resolves a common false positive, where we were reporting a leak inside
asserts
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150312 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 4fb548710837dc4e709e1a84f241c4bea121e895 |
|
11-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] MallocChecker: refactor/improve the symbol escape logic.
We use the same logic here as the RetainRelease checker.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150311 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| f8b1c316cb294d4d47579fbdf7d97d3260e2ba6e |
|
10-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] MallocChecker: add a list of false positives based on running
the checker over postgres and sqlite.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150216 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| e9ef5622a7600604b101f1843e7a3736eeb45d83 |
|
10-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] MallocChecker Cleanup - harden against crashes, fix an error
(use of return instead of continue), wording.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150215 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| ff3b9fdbfd4ff3a8361640c0d8a12d9f0cc1ce6f |
|
09-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] Add custom path diagnostic to the Malloc Checker.
Very simple so far - we just highlight every allocation and release
site.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150156 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| cdfec5e5ea0d1cfebe27888ef072346704424ed8 |
|
09-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] MallocChecker cleanup, more tests.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150155 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 91c2a1192cdd4e7b2b4ac7838c5aceef200ea251 |
|
09-Feb-2012 |
Anna Zaks <ganna@apple.com> |
[analyzer] MallocChecker: implement pessimistic version of the checker,
which allows values to escape through unknown calls.
Assumes all calls but the malloc family are unknown.
Also, catch a use-after-free when a pointer is passed to a
function after a call to free (previously, you had to explicitly
dereference the pointer value).
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@150112 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| d56763fd33321cb3d0f17804abecb379cea78c01 |
|
01-Sep-2011 |
Zhongxing Xu <xuzhongxing@foxmail.com> |
If size was equal to 0, either NULL or a pointer suitable to be passed to
free() is returned by realloc(). Most code expect NULL.
And we only need to transfer one final ProgramState.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@138937 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 033a07e5fca459ed184369cfee7c90d82367a93a |
|
04-Aug-2011 |
Ted Kremenek <kremenek@apple.com> |
[analyzer] rename all experimental checker packages to have 'experimental' be the common root package.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@136835 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 4d8d803b06804defe25346871c7beb6096540c4a |
|
27-Apr-2011 |
Lenny Maiorani <lenny@colorado.edu> |
More accurately model realloc() when the size argument is 0. realloc() with a size of 0 is equivalent to free(). The memory region should be marked as free and not used again.
Unit tests f2_realloc_0(), f6_realloc(), and f7_realloc() contributed by Marshall Clow <mclow.lists@gmail.com>. Thanks!
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@130303 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 5188507b9a1b09ec95c14ffadf0e832f2b47aa8a |
|
24-Mar-2011 |
Ted Kremenek <kremenek@apple.com> |
Rework checker "packages" and groups to be more hierarchical.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@128187 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| c4d2c9074be6eb2091086eddd6c8f052f3b245c8 |
|
28-Feb-2011 |
Argyrios Kyrtzidis <akyrtzi@gmail.com> |
[analyzer] Remove '-analyzer-check-objc-mem' flag, the nominee for best misnomer award.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126676 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 267aa5c93b1eecc1d6f2c65ed2ba1fe840a9d0fd |
|
28-Feb-2011 |
Argyrios Kyrtzidis <akyrtzi@gmail.com> |
[analyzer] Migrate UndefinedAssignmentChecker to CheckerV2.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126617 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 6dd4dffe1090e820e9b5b25eee8ad3907a1aa679 |
|
28-Feb-2011 |
Argyrios Kyrtzidis <akyrtzi@gmail.com> |
[analyzer] Remove '-analyzer-experimental-checks' flag.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126607 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 312dbec867f6b8d6b86fd562c53352cd4db27468 |
|
28-Feb-2011 |
Argyrios Kyrtzidis <akyrtzi@gmail.com> |
[analyzer] Migrate MallocChecker to CheckerV2.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126606 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 65d39251ff57b8e33cf6d3a7fcc6aa1c6f8cdc68 |
|
24-Feb-2011 |
Argyrios Kyrtzidis <akyrtzi@gmail.com> |
[analyzer] Remove '-analyzer-experimental-internal-checks' flag, it doesn't have any checkers associated with it anymore.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126440 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 0d6b0c00823410c8d532fc15e40c9b62ae43a08b |
|
24-Feb-2011 |
Argyrios Kyrtzidis <akyrtzi@gmail.com> |
[analyzer] Migrate CastSizeChecker to CheckerV2.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@126438 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| a0decc9a2481f938e1675b4f7bbd58761a882a36 |
|
15-Feb-2011 |
Argyrios Kyrtzidis <akyrtzi@gmail.com> |
[analyzer] Use the new registration mechanism on some of the experimental checks. These are:
CStringChecker
ChrootChecker
MallocChecker
PthreadLockChecker
StreamChecker
UnreachableCodeChecker
MallocChecker creates implicit dependencies between checkers and needs to be handled differently.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@125598 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| dd0e490c24aeade2c59ca4cae171199f6af9f02e |
|
31-Jul-2010 |
Ted Kremenek <kremenek@apple.com> |
After a lengthy design discussion, add support for "ownership attributes" for malloc/free checking. Patch by Andrew McGregor!
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@109939 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| c4b5bd89e1ef611c7a31b767763030acc45274c8 |
|
24-Jul-2010 |
Tom Care <tcare@apple.com> |
Added an path-sensitive unreachable code checker to the experimental analyzer checks.
- Created a new class to do post-analysis
- Updated several test cases with unreachable code to expect a warning
- Added some general tests
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@109286 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| c580f2e189810ae655c889536644470575bc551a |
|
20-Jun-2010 |
Jordy Rose <jediknil@belkadan.com> |
Casting to void* or any other pointer-to-sizeless type (e.g. function pointers) causes a divide-by-zero error. Simple fix: check if the pointee type size is 0 and bail out early if it is.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@106401 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| a5ce966d1a23d84aa5e849cf0ed62494e736ea6a |
|
01-Jun-2010 |
Zhongxing Xu <xuzhongxing@gmail.com> |
Add support for calloc() in MallocChecker. Patch by Jordy Rose, with my
modification.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@105264 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| ab28099e3bd4859585ccb316f9f571c8c6b035fd |
|
25-May-2010 |
Zhongxing Xu <xuzhongxing@gmail.com> |
CastSizeChecker checks when casting a malloc'ed symbolic region to type T,
whether the size of the symbolic region is a multiple of the size of T.
Fixes PR6123 and PR7217.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@104584 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| c8023788ace75cf0a0417b9b88e643ceebae91e2 |
|
10-Mar-2010 |
Zhongxing Xu <xuzhongxing@gmail.com> |
Add use-after-free check to MallocChecker.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@98136 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 181cc3df6e0046a154a8a174d551d57af4561998 |
|
14-Feb-2010 |
Zhongxing Xu <xuzhongxing@gmail.com> |
Fix pr6293. If ptr is NULL, no operation is preformed.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@96154 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 565e465c6d0093f1bf8414b2cabdc842022385a9 |
|
05-Feb-2010 |
Ted Kremenek <kremenek@apple.com> |
Rename -cc1 option '-checker-cfref' to '-analyzer-check-objc-mem'.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@95348 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 425c7ed03b5c7d4263f592416338642b6d99f3ba |
|
18-Jan-2010 |
Zhongxing Xu <xuzhongxing@gmail.com> |
Add test case for pr6069.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@93708 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| b94b81a9ab46c99b00c7ad28c5e1e212c63fc9ac |
|
31-Dec-2009 |
Zhongxing Xu <xuzhongxing@gmail.com> |
Let constraint manager inform checkers that some assumption logic has happend.
Add new states for symbolic regions tracked by malloc checker. This enables us
to do malloc checking more accurately. See test case.
Based on Lei Zhang's patch and discussion.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@92342 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| a5728872c7702ddd09537c95bc3cbd20e1f2fb09 |
|
15-Dec-2009 |
Daniel Dunbar <daniel@zuster.org> |
Update tests to use %clang_cc1 instead of 'clang-cc' or 'clang -cc1'.
- This is designed to make it obvious that %clang_cc1 is a "test variable"
which is substituted. It is '%clang_cc1' instead of '%clang -cc1' because it
can be useful to redefine what gets run as 'clang -cc1' (for example, to set
a default target).
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91446 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| ef74f4c6dcd59b3af1de9d8f613c1caf3e6cb63d |
|
14-Dec-2009 |
Zhongxing Xu <xuzhongxing@gmail.com> |
Replace clang-cc with clang -cc1.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91272 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| d9c84c8381261530b16512d2aac146de8271ea1e |
|
12-Dec-2009 |
Zhongxing Xu <xuzhongxing@gmail.com> |
Add initial support for realloc() in MallocChecker.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@91216 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 4985e3ec81679955e51d537d1186e243f9389d7a |
|
17-Nov-2009 |
Zhongxing Xu <xuzhongxing@gmail.com> |
Add PreVisitReturn to Malloc checker. Now we can recognize returned memory
block.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89071 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 243fde9f549a8f5f000c4baccb572dd0b7266a41 |
|
17-Nov-2009 |
Zhongxing Xu <xuzhongxing@gmail.com> |
Add EvalEndPath interface to Checker. Now we can check memory leaked at the
end of the path. Need to unify interfaces.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@89063 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 2f0055275755807395cbd94e636347ae53fb1f03 |
|
14-Nov-2009 |
Eli Friedman <eli.friedman@gmail.com> |
Fix a couple of tests.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@88756 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| c360775fb7ed8352ca26f08c0270d21a6cb19e7f |
|
13-Nov-2009 |
Ted Kremenek <kremenek@apple.com> |
Remove test case's dependency on header file.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@88685 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| c764d4b5b78607d189eb5299ceb6d1640c99df45 |
|
13-Nov-2009 |
Ted Kremenek <kremenek@apple.com> |
Add two new test cases for the Malloc/Free checker. Both have to do with
storing malloc'ed memory to global storage.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@88684 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| ba93087ebd43c0f7b3e980dc9e49a9313d9c9f01 |
|
13-Nov-2009 |
Ted Kremenek <kremenek@apple.com> |
Add test case that shows a leak we don't catch.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@88683 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| 8382cf57b722f130f1a6b45380639871c07271c1 |
|
13-Nov-2009 |
Ted Kremenek <kremenek@apple.com> |
Add clang-cc option "--analyzer-experimental-internal-checks". This
option enables new "internal" checks that will eventually be turned on
by default but still require broader testing.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@88671 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|
| fc7ac8f0b9ffd83b9e7329926e9e184586b49138 |
|
13-Nov-2009 |
Zhongxing Xu <xuzhongxing@gmail.com> |
Malloc checker basically works now.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@87094 91177308-0d34-0410-b5e6-96231b3b80d8
/external/clang/test/Analysis/malloc.c
|