clang  10.0.0svn
Namespaces | Macros | Enumerations | Functions
MallocChecker.cpp File Reference
#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
#include "InterCheckerAPI.h"
#include "clang/AST/Attr.h"
#include "clang/AST/ParentMap.h"
#include "clang/Basic/SourceManager.h"
#include "clang/Basic/TargetInfo.h"
#include "clang/Lex/Lexer.h"
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
#include "clang/StaticAnalyzer/Core/BugReporter/CommonBugCategories.h"
#include "clang/StaticAnalyzer/Core/Checker.h"
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
#include "llvm/ADT/STLExtras.h"
#include "llvm/ADT/SmallString.h"
#include "llvm/ADT/StringExtras.h"
#include "AllocationState.h"
#include <climits>
#include <utility>
Include dependency graph for MallocChecker.cpp:

Go to the source code of this file.

Namespaces

 clang
 Dataflow Directional Tag Classes.
 
 clang::ento
 
 clang::ento::allocation_state
 

Macros

#define CASE(ID)   case ID: OS << #ID; break;
 
#define REGISTER_CHECKER(name)
 

Enumerations

enum  AllocationFamily
 
enum  OwnershipAfterReallocKind
 The state of 'fromPtr' after reallocation is known to have failed. More...
 
enum  MemoryOperationKind
 

Functions

static AllocationFamily getAllocationFamily (const MemFunctionInfoTy &MemFunctionInfo, CheckerContext &C, const Stmt *S)
 Determine family of a deallocation expression. More...
 
static bool printAllocDeallocName (raw_ostream &os, CheckerContext &C, const Expr *E)
 Print names of allocators and deallocators. More...
 
static void printExpectedAllocName (raw_ostream &os, const MemFunctionInfoTy &MemFunctionInfo, CheckerContext &C, const Expr *E)
 Print expected name of an allocator based on the deallocator's family derived from the DeallocExpr. More...
 
static void printExpectedDeallocName (raw_ostream &os, AllocationFamily Family)
 Print expected name of a deallocator based on the allocator's family. More...
 
static bool isReleased (SymbolRef Sym, CheckerContext &C)
 Check if the memory associated with this symbol was released. More...
 
static ProgramStateRef MallocUpdateRefState (CheckerContext &C, const Expr *E, ProgramStateRef State, AllocationFamily Family=AF_Malloc, Optional< SVal > RetVal=None)
 Update the RefState to reflect the new memory allocation. More...
 
static QualType getDeepPointeeType (QualType T)
 
static bool hasNonTrivialConstructorCall (const CXXNewExpr *NE)
 
static bool isKnownDeallocObjCMethodName (const ObjCMethodCall &Call)
 
static Optional< boolgetFreeWhenDoneArg (const ObjCMethodCall &Call)
 
static bool didPreviousFreeFail (ProgramStateRef State, SymbolRef Sym, SymbolRef &RetStatusSymbol)
 Checks if the previous call to free on the given symbol failed - if free failed, returns true. More...
 
static bool checkIfNewOrNewArrayFamily (const RefState *RS)
 
static SymbolRef findFailedReallocSymbol (ProgramStateRef currState, ProgramStateRef prevState)
 
static bool isReferenceCountingPointerDestructor (const CXXDestructorDecl *DD)
 
ProgramStateRef clang::ento::allocation_state::markReleased (ProgramStateRef State, SymbolRef Sym, const Expr *Origin)
 

Macro Definition Documentation

◆ CASE

#define CASE (   ID)    case ID: OS << #ID; break;

◆ REGISTER_CHECKER

#define REGISTER_CHECKER (   name)
Value:
void ento::register##name(CheckerManager &mgr) { \
MallocChecker *checker = mgr.getChecker<MallocChecker>(); \
checker->ChecksEnabled[MallocChecker::CK_##name] = true; \
checker->CheckNames[MallocChecker::CK_##name] = \
mgr.getCurrentCheckerName(); \
} \
\
bool ento::shouldRegister##name(const LangOptions &LO) { return true; }
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
Definition: LangOptions.h:49
RangeSelector name(std::string ID)
Given a node with a "name", (like NamedDecl, DeclRefExpr or CxxCtorInitializer) selects the name&#39;s to...

Definition at line 3413 of file MallocChecker.cpp.

Enumeration Type Documentation

◆ AllocationFamily

Definition at line 80 of file MallocChecker.cpp.

◆ MemoryOperationKind

enum MemoryOperationKind
strong

Definition at line 274 of file MallocChecker.cpp.

◆ OwnershipAfterReallocKind

The state of 'fromPtr' after reallocation is known to have failed.

Definition at line 225 of file MallocChecker.cpp.

Function Documentation

◆ checkIfNewOrNewArrayFamily()

static bool checkIfNewOrNewArrayFamily ( const RefState *  RS)
static

Definition at line 3108 of file MallocChecker.cpp.

References clang::ento::PSK_DirectEscapeOnCall, and State.

◆ didPreviousFreeFail()

static bool didPreviousFreeFail ( ProgramStateRef  State,
SymbolRef  Sym,
SymbolRef &  RetStatusSymbol 
)
static

Checks if the previous call to free on the given symbol failed - if free failed, returns true.

Also, returns the corresponding return value symbol.

Definition at line 1616 of file MallocChecker.cpp.

References Ret().

Referenced by printExpectedDeallocName().

◆ findFailedReallocSymbol()

static SymbolRef findFailedReallocSymbol ( ProgramStateRef  currState,
ProgramStateRef  prevState 
)
static

Definition at line 3143 of file MallocChecker.cpp.

Referenced by isReferenceCountingPointerDestructor().

◆ getAllocationFamily()

static AllocationFamily getAllocationFamily ( const MemFunctionInfoTy &  MemFunctionInfo,
CheckerContext &  C,
const Stmt S 
)
static

◆ getDeepPointeeType()

static QualType getDeepPointeeType ( QualType  T)
static

Definition at line 1295 of file MallocChecker.cpp.

References clang::Type::getPointeeType().

Referenced by hasNonTrivialConstructorCall().

◆ getFreeWhenDoneArg()

static Optional<bool> getFreeWhenDoneArg ( const ObjCMethodCall Call)
static

◆ hasNonTrivialConstructorCall()

static bool hasNonTrivialConstructorCall ( const CXXNewExpr NE)
static

◆ isKnownDeallocObjCMethodName()

static bool isKnownDeallocObjCMethodName ( const ObjCMethodCall Call)
static

◆ isReferenceCountingPointerDestructor()

static bool isReferenceCountingPointerDestructor ( const CXXDestructorDecl DD)
static

◆ isReleased()

static bool isReleased ( SymbolRef  Sym,
CheckerContext &  C 
)
static

◆ MallocUpdateRefState()

static ProgramStateRef MallocUpdateRefState ( CheckerContext &  C,
const Expr E,
ProgramStateRef  State,
AllocationFamily  Family = AF_Malloc,
Optional< SVal >  RetVal = None 
)
static

Update the RefState to reflect the new memory allocation.

The optional RetVal parameter specifies the newly allocated pointer value; if unspecified, the value of expression E is used.

Definition at line 1554 of file MallocChecker.cpp.

References clang::CallExpr::getArg(), clang::CallExpr::getNumArgs(), and State.

Referenced by getFreeWhenDoneArg(), and hasNonTrivialConstructorCall().

◆ printAllocDeallocName()

static bool printAllocDeallocName ( raw_ostream &  os,
CheckerContext &  C,
const Expr E 
)
static

◆ printExpectedAllocName()

static void printExpectedAllocName ( raw_ostream &  os,
const MemFunctionInfoTy &  MemFunctionInfo,
CheckerContext &  C,
const Expr E 
)
static

Print expected name of an allocator based on the deallocator's family derived from the DeallocExpr.

Definition at line 1719 of file MallocChecker.cpp.

References getAllocationFamily().

Referenced by printExpectedDeallocName().

◆ printExpectedDeallocName()

static void printExpectedDeallocName ( raw_ostream &  os,
AllocationFamily  Family 
)
static