Commit Graph

26 Commits

Author SHA1 Message Date
Jordan Rose d02adbf03c [analyzer] Tests: move system functions into system header simulator files.
Some checkers ascribe different behavior to functions declared in system
headers, so when working with standard library functions it's probably best
to always have them in a standard location.

Test change only (no functionality change), but necessary for the next commit.

llvm-svn: 179552
2013-04-15 20:39:37 +00:00
David Blaikie 282ad876bd Implement GCC's -Wint-to-pointer-cast.
This implementation doesn't warn on anything that GCC doesn't warn on with the
exception of templates specializations (GCC doesn't warn, Clang does). The
specific skipped cases (boolean, constant expressions, enums) are open for
debate/adjustment if anyone wants to demonstrate that GCC is being overly
conservative here. The only really obvious false positive I found was in the
Clang regression suite's MPI test - apparently MPI uses specific flag values in
pointer constants. (eg: #define FOO (void*)~0)

llvm-svn: 166039
2012-10-16 18:53:14 +00:00
Ted Kremenek 722398f1d4 Fix analyzer tests.
llvm-svn: 162588
2012-08-24 20:39:55 +00:00
Ted Kremenek f534e91882 Having RegionStore lower field bindings to raw offsets, just like ElementRegions. This is a bit
disruptive, but it allows RegionStore to better "see" through casts that reinterpret arrays of values
as structs.  Fixes <rdar://problem/11405978>.

llvm-svn: 156428
2012-05-08 21:49:54 +00:00
Anna Zaks bf740512ec [analyzer] Add more C taint sources/sinks.
llvm-svn: 148844
2012-01-24 19:32:25 +00:00
Anna Zaks e04dadc248 [analyzer] Add another tests to taint tester.
llvm-svn: 147570
2012-01-04 23:54:04 +00:00
Anna Zaks 5f847144d1 [analyzer] Do not invalidate arguments when the parameter's
type is a pointer to const. (radar://10595327)

The regions corresponding to the pointer and reference arguments to
a function get invalidated by the calls since a function call can
possibly modify the pointed to data. With this change, we are not going
to invalidate the data if the argument is a pointer to const. This
change makes the analyzer more optimistic in reporting errors.
(Support for C, C++ and Obj C)

llvm-svn: 147002
2011-12-20 22:35:30 +00:00
Anna Zaks 79b5c26014 [analyzer] Fixup for r146793. Add tests for atol and atoll.
llvm-svn: 146794
2011-12-17 00:30:16 +00:00
Anna Zaks 3b0ab206d2 [analyzer] Add support for taint flowing through a function (atoi).
Check if the input parameters are tainted (or point to tainted data) on
a checkPreStmt<CallExpr>. If the output should be tainted, record it in
the state. On post visit (checkPostStmt<CallExpr>), use the state to
make decisions (in addition to the existing logic). Use this logic for
atoi and fscanf.

llvm-svn: 146793
2011-12-17 00:26:34 +00:00
Anna Zaks e48ee50324 [analyzer] Better stdin support.
llvm-svn: 146748
2011-12-16 18:28:50 +00:00
Anna Zaks a2510070ee Add support for matching one or more (aka regex +) diagnostic messages with -verify.
Ex:
// expected-warning + {{tainted}

llvm-svn: 146633
2011-12-15 02:28:16 +00:00
Anna Zaks 30373150a1 [analyzer] Ensure that the order in which checker callbacks are called
is deterministic.

Non-determinism was the reason for the test which caused the earlier
buildbot failures, so re-enable the test.

llvm-svn: 146628
2011-12-15 01:36:04 +00:00
Anna Zaks 93237e4808 [analyzer] Disable verification step on the failing test.
I need to keep the test itself in the repository since it's the only way I can currently reproduce the issue.

llvm-svn: 146582
2011-12-14 19:39:46 +00:00
Anna Zaks 72e90d54ae [analyzer] Re-enable the test which was failing on one of the bots.
I cannot reproduce the failures neither on my machine nor on the same buildbot machine (with the clang binary built on it). Let's see if it fails again..

llvm-svn: 146574
2011-12-14 18:34:17 +00:00
Anna Zaks 87ebe63542 [analyzer] Revert the taint test, which is failing on one of the bots for time being.
llvm-svn: 146541
2011-12-14 02:00:54 +00:00
Anna Zaks 099fe3fb28 [analyzer] Treat stdin as a source of taint.
Some of the test cases do not currently work because the analyzer core
does not seem to call checkers for pre/post DeclRefExpr visits.
(Opened radar://10573500. To be fixed later on.)

llvm-svn: 146536
2011-12-14 00:56:18 +00:00
Anna Zaks eefc0e9342 [analyzer] Mark output of fscanf and fopen as tainted.
llvm-svn: 146533
2011-12-14 00:56:02 +00:00
Anna Zaks d6bb3227de [analyzer] Mark getenv output as tainted.
Also, allow adding taint to a region (not only a symbolic value).

llvm-svn: 146532
2011-12-14 00:55:58 +00:00
Hans Wennborg b1a5e09f6f Check that arguments to a scanf call match the format specifier,
and offer fixits when there is a mismatch.

llvm-svn: 146326
2011-12-10 13:20:11 +00:00
Anna Zaks 6af472aa3b [analyzer] Fix inconsistency on when SValBuilder assumes that 2
types are equivalent.

+ A taint test which tests bitwise operations and which was
triggering an assertion due to presence of the integer to integer cast.

llvm-svn: 146240
2011-12-09 03:34:02 +00:00
Anna Zaks 394256cc0d [analyzer] If memory region is tainted mark data as tainted.
+ random comments

llvm-svn: 146199
2011-12-08 22:38:43 +00:00
Anna Zaks b86fdbe7e3 [analyzer] Propagate taint through MemRegions.
SVal can be not only a symbol, but a MemRegion. Add support for such
cases.

llvm-svn: 146006
2011-12-07 01:09:52 +00:00
Anna Zaks c25efccc8b [analyzer] Propagate taint through NonLoc to NonLoc casts.
- Created a new SymExpr type - SymbolCast.
 - SymbolCast is created when we don't know how to simplify a NonLoc to
NonLoc casts.
 - A bit of code refactoring: introduced dispatchCast to have better
code reuse, remove a goto.
 - Updated the test case to showcase the new taint flow.

llvm-svn: 145985
2011-12-06 23:12:27 +00:00
Anna Zaks d624f60a89 [analyzer] Simplify the expected-warning statement.
llvm-svn: 145855
2011-12-05 21:32:58 +00:00
Anna Zaks 004695b56e [analyzer] Add a missing taint tester warning.
llvm-svn: 145834
2011-12-05 18:58:33 +00:00
Anna Zaks 1c215d0a11 [analyzer] Add a debug checker to test for tainted data.
llvm-svn: 145827
2011-12-05 18:58:01 +00:00