clang  14.0.0git
Namespaces | Macros | Functions
MallocChecker.cpp File Reference
#include "AllocationState.h"
#include "InterCheckerAPI.h"
#include "clang/AST/Attr.h"
#include "clang/AST/DeclCXX.h"
#include "clang/AST/DeclTemplate.h"
#include "clang/AST/Expr.h"
#include "clang/AST/ExprCXX.h"
#include "clang/AST/ParentMap.h"
#include "clang/ASTMatchers/ASTMatchFinder.h"
#include "clang/ASTMatchers/ASTMatchers.h"
#include "clang/Analysis/ProgramPoint.h"
#include "clang/Basic/LLVM.h"
#include "clang/Basic/SourceManager.h"
#include "clang/Basic/TargetInfo.h"
#include "clang/Lex/Lexer.h"
#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
#include "clang/StaticAnalyzer/Core/BugReporter/CommonBugCategories.h"
#include "clang/StaticAnalyzer/Core/Checker.h"
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerHelpers.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/DynamicExtent.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/StoreRef.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
#include "llvm/ADT/STLExtras.h"
#include "llvm/ADT/SetOperations.h"
#include "llvm/ADT/SmallString.h"
#include "llvm/ADT/StringExtras.h"
#include "llvm/Support/Casting.h"
#include "llvm/Support/Compiler.h"
#include "llvm/Support/ErrorHandling.h"
#include "llvm/Support/raw_ostream.h"
#include <climits>
#include <functional>
#include <utility>
Include dependency graph for MallocChecker.cpp:

Go to the source code of this file.

Namespaces

 clang
 
 clang::ento
 
 clang::ento::allocation_state
 

Macros

#define CASE(ID)   case ID: OS << #ID; break;
 
#define CHECK_FN(NAME)   void NAME(const CallEvent &Call, CheckerContext &C) const;
 
#define REGISTER_CHECKER(name)
 

Functions

static bool printMemFnName (raw_ostream &os, CheckerContext &C, const Expr *E)
 Print names of allocators and deallocators. More...
 
static void printExpectedAllocName (raw_ostream &os, AllocationFamily Family)
 Print expected name of an allocator based on the deallocator's family derived from the DeallocExpr. More...
 
static void printExpectedDeallocName (raw_ostream &os, AllocationFamily Family)
 Print expected name of a deallocator based on the allocator's family. More...
 
static bool isReleased (SymbolRef Sym, CheckerContext &C)
 Check if the memory associated with this symbol was released. More...
 
static ProgramStateRef MallocUpdateRefState (CheckerContext &C, const Expr *E, ProgramStateRef State, AllocationFamily Family, Optional< SVal > RetVal=None)
 Update the RefState to reflect the new memory allocation. More...
 
static bool isStandardNewDelete (const FunctionDecl *FD)
 Tells if the callee is one of the builtin new/delete operators, including placement operators and other standard overloads. More...
 
static bool isStandardNewDelete (const CallEvent &Call)
 
static bool isStandardRealloc (const CallEvent &Call)
 
static bool isGRealloc (const CallEvent &Call)
 
static QualType getDeepPointeeType (QualType T)
 
static bool hasNonTrivialConstructorCall (const CXXNewExpr *NE)
 
static bool isKnownDeallocObjCMethodName (const ObjCMethodCall &Call)
 
static Optional< boolgetFreeWhenDoneArg (const ObjCMethodCall &Call)
 
static bool didPreviousFreeFail (ProgramStateRef State, SymbolRef Sym, SymbolRef &RetStatusSymbol)
 Checks if the previous call to free on the given symbol failed - if free failed, returns true. More...
 
static bool checkIfNewOrNewArrayFamily (const RefState *RS)
 
static SymbolRef findFailedReallocSymbol (ProgramStateRef currState, ProgramStateRef prevState)
 
static bool isReferenceCountingPointerDestructor (const CXXDestructorDecl *DD)
 
ProgramStateRef clang::ento::allocation_state::markReleased (ProgramStateRef State, SymbolRef Sym, const Expr *Origin)
 

Macro Definition Documentation

◆ CASE

#define CASE (   ID)    case ID: OS << #ID; break;

◆ CHECK_FN

#define CHECK_FN (   NAME)    void NAME(const CallEvent &Call, CheckerContext &C) const;

Definition at line 367 of file MallocChecker.cpp.

◆ REGISTER_CHECKER

#define REGISTER_CHECKER (   name)
Value:
void ento::register##name(CheckerManager &mgr) { \
MallocChecker *checker = mgr.getChecker<MallocChecker>(); \
checker->ChecksEnabled[MallocChecker::CK_##name] = true; \
checker->CheckNames[MallocChecker::CK_##name] = \
mgr.getCurrentCheckerName(); \
} \
\
bool ento::shouldRegister##name(const CheckerManager &mgr) { return true; }

Definition at line 3578 of file MallocChecker.cpp.

Function Documentation

◆ checkIfNewOrNewArrayFamily()

static bool checkIfNewOrNewArrayFamily ( const RefState *  RS)
static

Definition at line 3255 of file MallocChecker.cpp.

◆ didPreviousFreeFail()

static bool didPreviousFreeFail ( ProgramStateRef  State,
SymbolRef  Sym,
SymbolRef &  RetStatusSymbol 
)
static

Checks if the previous call to free on the given symbol failed - if free failed, returns true.

Also, returns the corresponding return value symbol.

Definition at line 1780 of file MallocChecker.cpp.

References Ret(), and State.

◆ findFailedReallocSymbol()

static SymbolRef findFailedReallocSymbol ( ProgramStateRef  currState,
ProgramStateRef  prevState 
)
static

Definition at line 3302 of file MallocChecker.cpp.

◆ getDeepPointeeType()

static QualType getDeepPointeeType ( QualType  T)
static

Definition at line 1529 of file MallocChecker.cpp.

References clang::Type::getPointeeType().

Referenced by hasNonTrivialConstructorCall().

◆ getFreeWhenDoneArg()

static Optional<bool> getFreeWhenDoneArg ( const ObjCMethodCall &  Call)
static

Definition at line 1617 of file MallocChecker.cpp.

◆ hasNonTrivialConstructorCall()

static bool hasNonTrivialConstructorCall ( const CXXNewExpr NE)
static
Returns
true if the constructor invoked by NE has an argument of a pointer/reference to a record type.

Definition at line 1540 of file MallocChecker.cpp.

References clang::Type::getAsCXXRecordDecl(), clang::CXXConstructExpr::getConstructor(), getDeepPointeeType(), clang::Type::getPointeeType(), clang::QualType::isNull(), clang::interp::NE(), and clang::FunctionDecl::parameters().

◆ isGRealloc()

static bool isGRealloc ( const CallEvent &  Call)
static

◆ isKnownDeallocObjCMethodName()

static bool isKnownDeallocObjCMethodName ( const ObjCMethodCall &  Call)
static

Definition at line 1605 of file MallocChecker.cpp.

◆ isReferenceCountingPointerDestructor()

static bool isReferenceCountingPointerDestructor ( const CXXDestructorDecl DD)
static

◆ isReleased()

static bool isReleased ( SymbolRef  Sym,
CheckerContext &  C 
)
static

Check if the memory associated with this symbol was released.

Definition at line 2955 of file MallocChecker.cpp.

◆ isStandardNewDelete() [1/2]

static bool isStandardNewDelete ( const CallEvent &  Call)
static

Definition at line 285 of file MallocChecker.cpp.

References isStandardNewDelete().

◆ isStandardNewDelete() [2/2]

static bool isStandardNewDelete ( const FunctionDecl FD)
static

Tells if the callee is one of the builtin new/delete operators, including placement operators and other standard overloads.

Definition at line 1044 of file MallocChecker.cpp.

References clang::Decl::getASTContext(), clang::Decl::getLocation(), clang::FunctionDecl::getOverloadedOperator(), clang::ASTContext::getSourceManager(), clang::SourceManager::isInSystemHeader(), and clang::SourceLocation::isValid().

Referenced by isStandardNewDelete().

◆ isStandardRealloc()

static bool isStandardRealloc ( const CallEvent &  Call)
static

◆ MallocUpdateRefState()

static ProgramStateRef MallocUpdateRefState ( CheckerContext &  C,
const Expr E,
ProgramStateRef  State,
AllocationFamily  Family,
Optional< SVal >  RetVal = None 
)
static

Update the RefState to reflect the new memory allocation.

The optional RetVal parameter specifies the newly allocated pointer value; if unspecified, the value of expression E is used.

Definition at line 1715 of file MallocChecker.cpp.

References State.

◆ printExpectedAllocName()

static void printExpectedAllocName ( raw_ostream &  os,
AllocationFamily  Family 
)
static

Print expected name of an allocator based on the deallocator's family derived from the DeallocExpr.

Definition at line 1832 of file MallocChecker.cpp.

◆ printExpectedDeallocName()

static void printExpectedDeallocName ( raw_ostream &  os,
AllocationFamily  Family 
)
static

Print expected name of a deallocator based on the allocator's family.

Definition at line 1845 of file MallocChecker.cpp.

◆ printMemFnName()

static bool printMemFnName ( raw_ostream &  os,
CheckerContext &  C,
const Expr E 
)
static

Print names of allocators and deallocators.

Returns
true on success.

Definition at line 1793 of file MallocChecker.cpp.

References clang::getOperatorSpelling(), clang::interp::NE(), and clang::Decl::print().

clang::transformer::name
RangeSelector name(std::string ID)
Given a node with a "name", (like NamedDecl, DeclRefExpr, CxxCtorInitializer, and TypeLoc) selects th...
Definition: RangeSelector.cpp:200