1 //===--- Checkers.td - Static Analyzer Checkers -===-----------------------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 include "clang/StaticAnalyzer/Checkers/CheckerBase.td"
12 //===----------------------------------------------------------------------===//
14 //===----------------------------------------------------------------------===//
16 def Alpha : Package<"alpha">;
18 def Core : Package<"core">;
19 def CoreBuiltin : Package<"builtin">, InPackage<Core>;
20 def CoreUninitialized : Package<"uninitialized">, InPackage<Core>;
21 def CoreAlpha : Package<"core">, InPackage<Alpha>, Hidden;
23 def Cplusplus : Package<"cplusplus">;
24 def CplusplusAlpha : Package<"cplusplus">, InPackage<Alpha>, Hidden;
26 def DeadCode : Package<"deadcode">;
27 def DeadCodeAlpha : Package<"deadcode">, InPackage<Alpha>, Hidden;
29 def Security : Package <"security">;
30 def InsecureAPI : Package<"insecureAPI">, InPackage<Security>;
31 def SecurityAlpha : Package<"security">, InPackage<Alpha>, Hidden;
32 def Taint : Package<"taint">, InPackage<SecurityAlpha>, Hidden;
34 def Unix : Package<"unix">;
35 def UnixAlpha : Package<"unix">, InPackage<Alpha>, Hidden;
36 def CString : Package<"cstring">, InPackage<Unix>, Hidden;
37 def CStringAlpha : Package<"cstring">, InPackage<UnixAlpha>, Hidden;
39 def OSX : Package<"osx">;
40 def OSXAlpha : Package<"osx">, InPackage<Alpha>, Hidden;
41 def Cocoa : Package<"cocoa">, InPackage<OSX>;
42 def CocoaAlpha : Package<"cocoa">, InPackage<OSXAlpha>, Hidden;
43 def CoreFoundation : Package<"coreFoundation">, InPackage<OSX>;
44 def Containers : Package<"containers">, InPackage<CoreFoundation>;
46 def LLVM : Package<"llvm">;
47 def Debug : Package<"debug">;
49 //===----------------------------------------------------------------------===//
51 //===----------------------------------------------------------------------===//
53 let ParentPackage = Core in {
55 def DereferenceChecker : Checker<"NullDereference">,
56 HelpText<"Check for dereferences of null pointers">,
57 DescFile<"DereferenceChecker.cpp">;
59 def CallAndMessageChecker : Checker<"CallAndMessage">,
60 HelpText<"Check for logical errors for function calls and Objective-C message expressions (e.g., uninitialized arguments, null function pointers)">,
61 DescFile<"CallAndMessageChecker.cpp">;
63 def NonNullParamChecker : Checker<"NonNullParamChecker">,
64 HelpText<"Check for null pointers passed as arguments to a function whose arguments are references or marked with the 'nonnull' attribute">,
65 DescFile<"NonNullParamChecker.cpp">;
67 def VLASizeChecker : Checker<"VLASize">,
68 HelpText<"Check for declarations of VLA of undefined or zero size">,
69 DescFile<"VLASizeChecker.cpp">;
71 def DivZeroChecker : Checker<"DivideZero">,
72 HelpText<"Check for division by zero">,
73 DescFile<"DivZeroChecker.cpp">;
75 def UndefResultChecker : Checker<"UndefinedBinaryOperatorResult">,
76 HelpText<"Check for undefined results of binary operators">,
77 DescFile<"UndefResultChecker.cpp">;
79 def StackAddrEscapeChecker : Checker<"StackAddressEscape">,
80 HelpText<"Check that addresses to stack memory do not escape the function">,
81 DescFile<"StackAddrEscapeChecker.cpp">;
83 def DynamicTypePropagation : Checker<"DynamicTypePropagation">,
84 HelpText<"Generate dynamic type information">,
85 DescFile<"DynamicTypePropagation.cpp">;
89 let ParentPackage = CoreAlpha in {
91 def BoolAssignmentChecker : Checker<"BoolAssignment">,
92 HelpText<"Warn about assigning non-{0,1} values to Boolean variables">,
93 DescFile<"BoolAssignmentChecker.cpp">;
95 def CastSizeChecker : Checker<"CastSize">,
96 HelpText<"Check when casting a malloc'ed type T, whether the size is a multiple of the size of T">,
97 DescFile<"CastSizeChecker.cpp">;
99 def CastToStructChecker : Checker<"CastToStruct">,
100 HelpText<"Check for cast from non-struct pointer to struct pointer">,
101 DescFile<"CastToStructChecker.cpp">;
103 def IdenticalExprChecker : Checker<"IdenticalExpr">,
104 HelpText<"Warn about unintended use of identical expressions in operators">,
105 DescFile<"IdenticalExprChecker.cpp">;
107 def FixedAddressChecker : Checker<"FixedAddr">,
108 HelpText<"Check for assignment of a fixed address to a pointer">,
109 DescFile<"FixedAddressChecker.cpp">;
111 def PointerArithChecker : Checker<"PointerArithm">,
112 HelpText<"Check for pointer arithmetic on locations other than array elements">,
113 DescFile<"PointerArithChecker">;
115 def PointerSubChecker : Checker<"PointerSub">,
116 HelpText<"Check for pointer subtractions on two pointers pointing to different memory chunks">,
117 DescFile<"PointerSubChecker">;
119 def SizeofPointerChecker : Checker<"SizeofPtr">,
120 HelpText<"Warn about unintended use of sizeof() on pointer expressions">,
121 DescFile<"CheckSizeofPointer.cpp">;
123 } // end "alpha.core"
125 //===----------------------------------------------------------------------===//
126 // Evaluate "builtin" functions.
127 //===----------------------------------------------------------------------===//
129 let ParentPackage = CoreBuiltin in {
131 def NoReturnFunctionChecker : Checker<"NoReturnFunctions">,
132 HelpText<"Evaluate \"panic\" functions that are known to not return to the caller">,
133 DescFile<"NoReturnFunctionChecker.cpp">;
135 def BuiltinFunctionChecker : Checker<"BuiltinFunctions">,
136 HelpText<"Evaluate compiler builtin functions (e.g., alloca())">,
137 DescFile<"BuiltinFunctionChecker.cpp">;
139 } // end "core.builtin"
141 //===----------------------------------------------------------------------===//
142 // Uninitialized values checkers.
143 //===----------------------------------------------------------------------===//
145 let ParentPackage = CoreUninitialized in {
147 def UndefinedArraySubscriptChecker : Checker<"ArraySubscript">,
148 HelpText<"Check for uninitialized values used as array subscripts">,
149 DescFile<"UndefinedArraySubscriptChecker.cpp">;
151 def UndefinedAssignmentChecker : Checker<"Assign">,
152 HelpText<"Check for assigning uninitialized values">,
153 DescFile<"UndefinedAssignmentChecker.cpp">;
155 def UndefBranchChecker : Checker<"Branch">,
156 HelpText<"Check for uninitialized values used as branch conditions">,
157 DescFile<"UndefBranchChecker.cpp">;
159 def UndefCapturedBlockVarChecker : Checker<"CapturedBlockVariable">,
160 HelpText<"Check for blocks that capture uninitialized values">,
161 DescFile<"UndefCapturedBlockVarChecker.cpp">;
163 def ReturnUndefChecker : Checker<"UndefReturn">,
164 HelpText<"Check for uninitialized values being returned to the caller">,
165 DescFile<"ReturnUndefChecker.cpp">;
167 } // end "core.uninitialized"
169 //===----------------------------------------------------------------------===//
171 //===----------------------------------------------------------------------===//
173 let ParentPackage = Cplusplus in {
175 def NewDeleteChecker : Checker<"NewDelete">,
176 HelpText<"Check for double-free and use-after-free problems. Traces memory managed by new/delete.">,
177 DescFile<"MallocChecker.cpp">;
179 } // end: "cplusplus"
181 let ParentPackage = CplusplusAlpha in {
183 def VirtualCallChecker : Checker<"VirtualCall">,
184 HelpText<"Check virtual function calls during construction or destruction">,
185 DescFile<"VirtualCallChecker.cpp">;
187 def NewDeleteLeaksChecker : Checker<"NewDeleteLeaks">,
188 HelpText<"Check for memory leaks. Traces memory managed by new/delete.">,
189 DescFile<"MallocChecker.cpp">;
191 } // end: "alpha.cplusplus"
193 //===----------------------------------------------------------------------===//
194 // Deadcode checkers.
195 //===----------------------------------------------------------------------===//
197 let ParentPackage = DeadCode in {
199 def DeadStoresChecker : Checker<"DeadStores">,
200 HelpText<"Check for values stored to variables that are never read afterwards">,
201 DescFile<"DeadStoresChecker.cpp">;
204 let ParentPackage = DeadCodeAlpha in {
206 def IdempotentOperationChecker : Checker<"IdempotentOperations">,
207 HelpText<"Warn about idempotent operations">,
208 DescFile<"IdempotentOperationChecker.cpp">;
210 def UnreachableCodeChecker : Checker<"UnreachableCode">,
211 HelpText<"Check unreachable code">,
212 DescFile<"UnreachableCodeChecker.cpp">;
214 } // end "alpha.deadcode"
216 //===----------------------------------------------------------------------===//
217 // Security checkers.
218 //===----------------------------------------------------------------------===//
220 let ParentPackage = InsecureAPI in {
221 def gets : Checker<"gets">,
222 HelpText<"Warn on uses of the 'gets' function">,
223 DescFile<"CheckSecuritySyntaxOnly.cpp">;
224 def getpw : Checker<"getpw">,
225 HelpText<"Warn on uses of the 'getpw' function">,
226 DescFile<"CheckSecuritySyntaxOnly.cpp">;
227 def mktemp : Checker<"mktemp">,
228 HelpText<"Warn on uses of the 'mktemp' function">,
229 DescFile<"CheckSecuritySyntaxOnly.cpp">;
230 def mkstemp : Checker<"mkstemp">,
231 HelpText<"Warn when 'mkstemp' is passed fewer than 6 X's in the format string">,
232 DescFile<"CheckSecuritySyntaxOnly.cpp">;
233 def rand : Checker<"rand">,
234 HelpText<"Warn on uses of the 'rand', 'random', and related functions">,
235 DescFile<"CheckSecuritySyntaxOnly.cpp">;
236 def strcpy : Checker<"strcpy">,
237 HelpText<"Warn on uses of the 'strcpy' and 'strcat' functions">,
238 DescFile<"CheckSecuritySyntaxOnly.cpp">;
239 def vfork : Checker<"vfork">,
240 HelpText<"Warn on uses of the 'vfork' function">,
241 DescFile<"CheckSecuritySyntaxOnly.cpp">;
242 def UncheckedReturn : Checker<"UncheckedReturn">,
243 HelpText<"Warn on uses of functions whose return values must be always checked">,
244 DescFile<"CheckSecuritySyntaxOnly.cpp">;
246 let ParentPackage = Security in {
247 def FloatLoopCounter : Checker<"FloatLoopCounter">,
248 HelpText<"Warn on using a floating point value as a loop counter (CERT: FLP30-C, FLP30-CPP)">,
249 DescFile<"CheckSecuritySyntaxOnly.cpp">;
252 let ParentPackage = SecurityAlpha in {
254 def ArrayBoundChecker : Checker<"ArrayBound">,
255 HelpText<"Warn about buffer overflows (older checker)">,
256 DescFile<"ArrayBoundChecker.cpp">;
258 def ArrayBoundCheckerV2 : Checker<"ArrayBoundV2">,
259 HelpText<"Warn about buffer overflows (newer checker)">,
260 DescFile<"ArrayBoundCheckerV2.cpp">;
262 def ReturnPointerRangeChecker : Checker<"ReturnPtrRange">,
263 HelpText<"Check for an out-of-bound pointer being returned to callers">,
264 DescFile<"ReturnPointerRangeChecker.cpp">;
266 def MallocOverflowSecurityChecker : Checker<"MallocOverflow">,
267 HelpText<"Check for overflows in the arguments to malloc()">,
268 DescFile<"MallocOverflowSecurityChecker.cpp">;
270 } // end "alpha.security"
272 //===----------------------------------------------------------------------===//
274 //===----------------------------------------------------------------------===//
276 let ParentPackage = Taint in {
278 def GenericTaintChecker : Checker<"TaintPropagation">,
279 HelpText<"Generate taint information used by other checkers">,
280 DescFile<"GenericTaintChecker.cpp">;
282 } // end "alpha.security.taint"
284 //===----------------------------------------------------------------------===//
285 // Unix API checkers.
286 //===----------------------------------------------------------------------===//
288 let ParentPackage = Unix in {
290 def UnixAPIChecker : Checker<"API">,
291 HelpText<"Check calls to various UNIX/Posix functions">,
292 DescFile<"UnixAPIChecker.cpp">;
294 def MallocPessimistic : Checker<"Malloc">,
295 HelpText<"Check for memory leaks, double free, and use-after-free problems. Traces memory managed by malloc()/free().">,
296 DescFile<"MallocChecker.cpp">;
298 def MallocSizeofChecker : Checker<"MallocSizeof">,
299 HelpText<"Check for dubious malloc arguments involving sizeof">,
300 DescFile<"MallocSizeofChecker.cpp">;
302 def MismatchedDeallocatorChecker : Checker<"MismatchedDeallocator">,
303 HelpText<"Check for mismatched deallocators.">,
304 DescFile<"MallocChecker.cpp">;
308 let ParentPackage = UnixAlpha in {
310 def ChrootChecker : Checker<"Chroot">,
311 HelpText<"Check improper use of chroot">,
312 DescFile<"ChrootChecker.cpp">;
314 def MallocOptimistic : Checker<"MallocWithAnnotations">,
315 HelpText<"Check for memory leaks, double free, and use-after-free problems. Traces memory managed by malloc()/free(). Assumes that all user-defined functions which might free a pointer are annotated.">,
316 DescFile<"MallocChecker.cpp">;
318 def PthreadLockChecker : Checker<"PthreadLock">,
319 HelpText<"Simple lock -> unlock checker">,
320 DescFile<"PthreadLockChecker.cpp">;
322 def StreamChecker : Checker<"Stream">,
323 HelpText<"Check stream handling functions">,
324 DescFile<"StreamChecker.cpp">;
326 def SimpleStreamChecker : Checker<"SimpleStream">,
327 HelpText<"Check for misuses of stream APIs">,
328 DescFile<"SimpleStreamChecker.cpp">;
330 } // end "alpha.unix"
332 let ParentPackage = CString in {
334 def CStringNullArg : Checker<"NullArg">,
335 HelpText<"Check for null pointers being passed as arguments to C string functions">,
336 DescFile<"CStringChecker.cpp">;
338 def CStringSyntaxChecker : Checker<"BadSizeArg">,
339 HelpText<"Check the size argument passed into C string functions for common erroneous patterns">,
340 DescFile<"CStringSyntaxChecker.cpp">;
343 let ParentPackage = CStringAlpha in {
345 def CStringOutOfBounds : Checker<"OutOfBounds">,
346 HelpText<"Check for out-of-bounds access in string functions">,
347 DescFile<"CStringChecker.cpp">;
349 def CStringBufferOverlap : Checker<"BufferOverlap">,
350 HelpText<"Checks for overlap in two buffer arguments">,
351 DescFile<"CStringChecker.cpp">;
353 def CStringNotNullTerm : Checker<"NotNullTerminated">,
354 HelpText<"Check for arguments which are not null-terminating strings">,
355 DescFile<"CStringChecker.cpp">;
358 //===----------------------------------------------------------------------===//
359 // Mac OS X, Cocoa, and Core Foundation checkers.
360 //===----------------------------------------------------------------------===//
362 let ParentPackage = OSX in {
364 def MacOSXAPIChecker : Checker<"API">,
366 HelpText<"Check for proper uses of various Apple APIs">,
367 DescFile<"MacOSXAPIChecker.cpp">;
369 def MacOSKeychainAPIChecker : Checker<"SecKeychainAPI">,
371 HelpText<"Check for proper uses of Secure Keychain APIs">,
372 DescFile<"MacOSKeychainAPIChecker.cpp">;
376 let ParentPackage = Cocoa in {
378 def ObjCAtSyncChecker : Checker<"AtSync">,
379 HelpText<"Check for nil pointers used as mutexes for @synchronized">,
380 DescFile<"ObjCAtSyncChecker.cpp">;
382 def NilArgChecker : Checker<"NilArg">,
383 HelpText<"Check for prohibited nil arguments to ObjC method calls">,
384 DescFile<"BasicObjCFoundationChecks.cpp">;
386 def ClassReleaseChecker : Checker<"ClassRelease">,
387 HelpText<"Check for sending 'retain', 'release', or 'autorelease' directly to a Class">,
388 DescFile<"BasicObjCFoundationChecks.cpp">;
390 def VariadicMethodTypeChecker : Checker<"VariadicMethodTypes">,
391 HelpText<"Check for passing non-Objective-C types to variadic collection "
392 "initialization methods that expect only Objective-C types">,
393 DescFile<"BasicObjCFoundationChecks.cpp">;
395 def NSAutoreleasePoolChecker : Checker<"NSAutoreleasePool">,
396 HelpText<"Warn for suboptimal uses of NSAutoreleasePool in Objective-C GC mode">,
397 DescFile<"NSAutoreleasePoolChecker.cpp">;
399 def ObjCMethSigsChecker : Checker<"IncompatibleMethodTypes">,
400 HelpText<"Warn about Objective-C method signatures with type incompatibilities">,
401 DescFile<"CheckObjCInstMethSignature.cpp">;
403 def ObjCUnusedIvarsChecker : Checker<"UnusedIvars">,
404 HelpText<"Warn about private ivars that are never used">,
405 DescFile<"ObjCUnusedIVarsChecker.cpp">;
407 def ObjCSelfInitChecker : Checker<"SelfInit">,
408 HelpText<"Check that 'self' is properly initialized inside an initializer method">,
409 DescFile<"ObjCSelfInitChecker.cpp">;
411 def ObjCLoopChecker : Checker<"Loops">,
412 HelpText<"Improved modeling of loops using Cocoa collection types">,
413 DescFile<"BasicObjCFoundationChecks.cpp">;
415 def ObjCNonNilReturnValueChecker : Checker<"NonNilReturnValue">,
416 HelpText<"Model the APIs that are guaranteed to return a non-nil value">,
417 DescFile<"BasicObjCFoundationChecks.cpp">;
419 def NSErrorChecker : Checker<"NSError">,
420 HelpText<"Check usage of NSError** parameters">,
421 DescFile<"NSErrorChecker.cpp">;
423 def RetainCountChecker : Checker<"RetainCount">,
424 HelpText<"Check for leaks and improper reference count management">,
425 DescFile<"RetainCountChecker.cpp">;
429 let ParentPackage = CocoaAlpha in {
431 def ObjCDeallocChecker : Checker<"Dealloc">,
432 HelpText<"Warn about Objective-C classes that lack a correct implementation of -dealloc">,
433 DescFile<"CheckObjCDealloc.cpp">;
435 def InstanceVariableInvalidation : Checker<"InstanceVariableInvalidation">,
436 HelpText<"Check that the invalidatable instance variables are invalidated in the methods annotated with objc_instance_variable_invalidator">,
437 DescFile<"IvarInvalidationChecker.cpp">;
439 def MissingInvalidationMethod : Checker<"MissingInvalidationMethod">,
440 HelpText<"Check that the invalidation methods are present in classes that contain invalidatable instance variables">,
441 DescFile<"IvarInvalidationChecker.cpp">;
443 def DirectIvarAssignment : Checker<"DirectIvarAssignment">,
444 HelpText<"Check for direct assignments to instance variables">,
445 DescFile<"DirectIvarAssignment.cpp">;
447 def DirectIvarAssignmentForAnnotatedFunctions : Checker<"DirectIvarAssignmentForAnnotatedFunctions">,
448 HelpText<"Check for direct assignments to instance variables in the methods annotated with objc_no_direct_instance_variable_assignment">,
449 DescFile<"DirectIvarAssignment.cpp">;
451 def ObjCSuperCallChecker : Checker<"MissingSuperCall">,
452 HelpText<"Warn about Objective-C methods that lack a necessary call to super">,
453 DescFile<"ObjCMissingSuperCallChecker.cpp">;
455 } // end "alpha.osx.cocoa"
457 let ParentPackage = CoreFoundation in {
459 def CFNumberCreateChecker : Checker<"CFNumber">,
460 HelpText<"Check for proper uses of CFNumberCreate">,
461 DescFile<"BasicObjCFoundationChecks.cpp">;
463 def CFRetainReleaseChecker : Checker<"CFRetainRelease">,
464 HelpText<"Check for null arguments to CFRetain/CFRelease/CFMakeCollectable">,
465 DescFile<"BasicObjCFoundationChecks.cpp">;
467 def CFErrorChecker : Checker<"CFError">,
468 HelpText<"Check usage of CFErrorRef* parameters">,
469 DescFile<"NSErrorChecker.cpp">;
472 let ParentPackage = Containers in {
473 def ObjCContainersASTChecker : Checker<"PointerSizedValues">,
474 HelpText<"Warns if 'CFArray', 'CFDictionary', 'CFSet' are created with non-pointer-size values">,
475 DescFile<"ObjCContainersASTChecker.cpp">;
477 def ObjCContainersChecker : Checker<"OutOfBounds">,
478 HelpText<"Checks for index out-of-bounds when using 'CFArray' API">,
479 DescFile<"ObjCContainersChecker.cpp">;
482 //===----------------------------------------------------------------------===//
483 // Checkers for LLVM development.
484 //===----------------------------------------------------------------------===//
486 def LLVMConventionsChecker : Checker<"Conventions">,
488 HelpText<"Check code for LLVM codebase conventions">,
489 DescFile<"LLVMConventionsChecker.cpp">;
491 //===----------------------------------------------------------------------===//
492 // Debugging checkers (for analyzer development).
493 //===----------------------------------------------------------------------===//
495 let ParentPackage = Debug in {
497 def DominatorsTreeDumper : Checker<"DumpDominators">,
498 HelpText<"Print the dominance tree for a given CFG">,
499 DescFile<"DebugCheckers.cpp">;
501 def LiveVariablesDumper : Checker<"DumpLiveVars">,
502 HelpText<"Print results of live variable analysis">,
503 DescFile<"DebugCheckers.cpp">;
505 def CFGViewer : Checker<"ViewCFG">,
506 HelpText<"View Control-Flow Graphs using GraphViz">,
507 DescFile<"DebugCheckers.cpp">;
509 def CFGDumper : Checker<"DumpCFG">,
510 HelpText<"Display Control-Flow Graphs">,
511 DescFile<"DebugCheckers.cpp">;
513 def CallGraphViewer : Checker<"ViewCallGraph">,
514 HelpText<"View Call Graph using GraphViz">,
515 DescFile<"DebugCheckers.cpp">;
517 def CallGraphDumper : Checker<"DumpCallGraph">,
518 HelpText<"Display Call Graph">,
519 DescFile<"DebugCheckers.cpp">;
521 def ConfigDumper : Checker<"ConfigDumper">,
522 HelpText<"Dump config table">,
523 DescFile<"DebugCheckers.cpp">;
525 def TraversalDumper : Checker<"DumpTraversal">,
526 HelpText<"Print branch conditions as they are traversed by the engine">,
527 DescFile<"TraversalChecker.cpp">;
529 def CallDumper : Checker<"DumpCalls">,
530 HelpText<"Print calls as they are traversed by the engine">,
531 DescFile<"TraversalChecker.cpp">;
533 def AnalyzerStatsChecker : Checker<"Stats">,
534 HelpText<"Emit warnings with analyzer statistics">,
535 DescFile<"AnalyzerStatsChecker.cpp">;
537 def TaintTesterChecker : Checker<"TaintTest">,
538 HelpText<"Mark tainted symbols as such.">,
539 DescFile<"TaintTesterChecker.cpp">;
541 def ExprInspectionChecker : Checker<"ExprInspection">,
542 HelpText<"Check the analyzer's understanding of expressions">,
543 DescFile<"ExprInspectionChecker.cpp">;
545 def ExplodedGraphViewer : Checker<"ViewExplodedGraph">,
546 HelpText<"View Exploded Graphs using GraphViz">,
547 DescFile<"DebugCheckers.cpp">;