Szelethus updated this revision to Diff 195619.
Szelethus edited the summary of this revision.
Szelethus added a comment.
Uhh, sorry for the spam. Realized that these are not path sensitive checkers.
Removed the core packages from the invocations. Actual logic of the patch is
untouched.
CHANGES SINCE LAST ACTION
https://reviews.llvm.org/D59812/new/
https://reviews.llvm.org/D59812
Files:
lib/StaticAnalyzer/Checkers/CheckSecuritySyntaxOnly.cpp
test/Analysis/security-syntax-checks-no-emit.c
test/Analysis/security-syntax-checks.c
test/Analysis/security-syntax-checks.m
Index: test/Analysis/security-syntax-checks.m
===================================================================
--- test/Analysis/security-syntax-checks.m
+++ test/Analysis/security-syntax-checks.m
@@ -1,11 +1,40 @@
-// RUN: %clang_analyze_cc1 -triple i386-apple-darwin10
-analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify
-// RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 -DUSE_BUILTINS
-analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify
-// RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 -DVARIANT
-analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify
-// RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 -DUSE_BUILTINS
-DVARIANT -analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s
-verify
-// RUN: %clang_analyze_cc1 -triple x86_64-unknown-cloudabi
-analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify
-// RUN: %clang_analyze_cc1 -triple x86_64-unknown-cloudabi -DUSE_BUILTINS
-analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify
-// RUN: %clang_analyze_cc1 -triple x86_64-unknown-cloudabi -DVARIANT
-analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify
-// RUN: %clang_analyze_cc1 -triple x86_64-unknown-cloudabi -DUSE_BUILTINS
-DVARIANT -analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s
-verify
+// RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 %s -verify \
+// RUN: -analyzer-checker=security.insecureAPI \
+// RUN: -analyzer-checker=security.FloatLoopCounter
+
+// RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 %s -verify \
+// RUN: -DUSE_BUILTINS \
+// RUN: -analyzer-checker=security.insecureAPI \
+// RUN: -analyzer-checker=security.FloatLoopCounter
+
+// RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 %s -verify \
+// RUN: -DVARIANT \
+// RUN: -analyzer-checker=security.insecureAPI \
+// RUN: -analyzer-checker=security.FloatLoopCounter
+
+// RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 %s -verify \
+// RUN: -DUSE_BUILTINS -DVARIANT \
+// RUN: -analyzer-checker=security.insecureAPI \
+// RUN: -analyzer-checker=security.FloatLoopCounter
+
+// RUN: %clang_analyze_cc1 -triple x86_64-unknown-cloudabi %s -verify \
+// RUN: -analyzer-checker=security.insecureAPI \
+// RUN: -analyzer-checker=security.FloatLoopCounter
+
+// RUN: %clang_analyze_cc1 -triple x86_64-unknown-cloudabi %s -verify \
+// RUN: -DUSE_BUILTINS \
+// RUN: -analyzer-checker=security.insecureAPI \
+// RUN: -analyzer-checker=security.FloatLoopCounter
+
+// RUN: %clang_analyze_cc1 -triple x86_64-unknown-cloudabi %s -verify \
+// RUN: -DVARIANT \
+// RUN: -analyzer-checker=security.insecureAPI \
+// RUN: -analyzer-checker=security.FloatLoopCounter
+
+// RUN: %clang_analyze_cc1 -triple x86_64-unknown-cloudabi %s -verify \
+// RUN: -DUSE_BUILTINS -DVARIANT \
+// RUN: -analyzer-checker=security.insecureAPI \
+// RUN: -analyzer-checker=security.FloatLoopCounter
#ifdef USE_BUILTINS
# define BUILTIN(f) __builtin_ ## f
Index: test/Analysis/security-syntax-checks.c
===================================================================
--- /dev/null
+++ test/Analysis/security-syntax-checks.c
@@ -0,0 +1,8 @@
+// RUN: %clang_analyze_cc1 %s -verify \
+// RUN: -analyzer-checker=security.insecureAPI
+
+void builtin_function_call_crash_fixes(char *c) {
+ __builtin_strncpy(c, "", 6); // expected-warning{{Call to function 'strncpy'
is insecure as it does not provide security checks introduced in the C11
standard.}}
+ __builtin_memset(c, '\0', (0)); // expected-warning{{Call to function
'memset' is insecure as it does not provide security checks introduced in the
C11 standard.}}
+ __builtin_memcpy(c, c, 0); // expected-warning{{Call to function 'memcpy' is
insecure as it does not provide security checks introduced in the C11
standard.}}
+}
Index: test/Analysis/security-syntax-checks-no-emit.c
===================================================================
--- test/Analysis/security-syntax-checks-no-emit.c
+++ test/Analysis/security-syntax-checks-no-emit.c
@@ -1,4 +1,7 @@
-// RUN: %clang_analyze_cc1 -triple i686-pc-linux-gnu
-analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify
+// RUN: %clang_analyze_cc1 -triple i686-pc-linux-gnu %s -verify \
+// RUN: -analyzer-checker=security.insecureAPI \
+// RUN: -analyzer-checker=security.FloatLoopCounter
+
// expected-no-diagnostics
// This file complements 'security-syntax-checks.m', but tests that we omit
Index: lib/StaticAnalyzer/Checkers/CheckSecuritySyntaxOnly.cpp
===================================================================
--- lib/StaticAnalyzer/Checkers/CheckSecuritySyntaxOnly.cpp
+++ lib/StaticAnalyzer/Checkers/CheckSecuritySyntaxOnly.cpp
@@ -740,7 +740,11 @@
// Issue a warning. ArgIndex == -1: Deprecated but not unsafe (has size
// restrictions).
enum { DEPR_ONLY = -1, UNKNOWN_CALL = -2 };
+
StringRef Name = FD->getIdentifier()->getName();
+ if (Name.startswith("__builtin_"))
+ Name = Name.substr(10);
+
int ArgIndex =
llvm::StringSwitch<int>(Name)
.Cases("scanf", "wscanf", "vscanf", "vwscanf", 0)
Index: test/Analysis/security-syntax-checks.m
===================================================================
--- test/Analysis/security-syntax-checks.m
+++ test/Analysis/security-syntax-checks.m
@@ -1,11 +1,40 @@
-// RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 -analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify
-// RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 -DUSE_BUILTINS -analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify
-// RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 -DVARIANT -analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify
-// RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 -DUSE_BUILTINS -DVARIANT -analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify
-// RUN: %clang_analyze_cc1 -triple x86_64-unknown-cloudabi -analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify
-// RUN: %clang_analyze_cc1 -triple x86_64-unknown-cloudabi -DUSE_BUILTINS -analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify
-// RUN: %clang_analyze_cc1 -triple x86_64-unknown-cloudabi -DVARIANT -analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify
-// RUN: %clang_analyze_cc1 -triple x86_64-unknown-cloudabi -DUSE_BUILTINS -DVARIANT -analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify
+// RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 %s -verify \
+// RUN: -analyzer-checker=security.insecureAPI \
+// RUN: -analyzer-checker=security.FloatLoopCounter
+
+// RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 %s -verify \
+// RUN: -DUSE_BUILTINS \
+// RUN: -analyzer-checker=security.insecureAPI \
+// RUN: -analyzer-checker=security.FloatLoopCounter
+
+// RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 %s -verify \
+// RUN: -DVARIANT \
+// RUN: -analyzer-checker=security.insecureAPI \
+// RUN: -analyzer-checker=security.FloatLoopCounter
+
+// RUN: %clang_analyze_cc1 -triple i386-apple-darwin10 %s -verify \
+// RUN: -DUSE_BUILTINS -DVARIANT \
+// RUN: -analyzer-checker=security.insecureAPI \
+// RUN: -analyzer-checker=security.FloatLoopCounter
+
+// RUN: %clang_analyze_cc1 -triple x86_64-unknown-cloudabi %s -verify \
+// RUN: -analyzer-checker=security.insecureAPI \
+// RUN: -analyzer-checker=security.FloatLoopCounter
+
+// RUN: %clang_analyze_cc1 -triple x86_64-unknown-cloudabi %s -verify \
+// RUN: -DUSE_BUILTINS \
+// RUN: -analyzer-checker=security.insecureAPI \
+// RUN: -analyzer-checker=security.FloatLoopCounter
+
+// RUN: %clang_analyze_cc1 -triple x86_64-unknown-cloudabi %s -verify \
+// RUN: -DVARIANT \
+// RUN: -analyzer-checker=security.insecureAPI \
+// RUN: -analyzer-checker=security.FloatLoopCounter
+
+// RUN: %clang_analyze_cc1 -triple x86_64-unknown-cloudabi %s -verify \
+// RUN: -DUSE_BUILTINS -DVARIANT \
+// RUN: -analyzer-checker=security.insecureAPI \
+// RUN: -analyzer-checker=security.FloatLoopCounter
#ifdef USE_BUILTINS
# define BUILTIN(f) __builtin_ ## f
Index: test/Analysis/security-syntax-checks.c
===================================================================
--- /dev/null
+++ test/Analysis/security-syntax-checks.c
@@ -0,0 +1,8 @@
+// RUN: %clang_analyze_cc1 %s -verify \
+// RUN: -analyzer-checker=security.insecureAPI
+
+void builtin_function_call_crash_fixes(char *c) {
+ __builtin_strncpy(c, "", 6); // expected-warning{{Call to function 'strncpy' is insecure as it does not provide security checks introduced in the C11 standard.}}
+ __builtin_memset(c, '\0', (0)); // expected-warning{{Call to function 'memset' is insecure as it does not provide security checks introduced in the C11 standard.}}
+ __builtin_memcpy(c, c, 0); // expected-warning{{Call to function 'memcpy' is insecure as it does not provide security checks introduced in the C11 standard.}}
+}
Index: test/Analysis/security-syntax-checks-no-emit.c
===================================================================
--- test/Analysis/security-syntax-checks-no-emit.c
+++ test/Analysis/security-syntax-checks-no-emit.c
@@ -1,4 +1,7 @@
-// RUN: %clang_analyze_cc1 -triple i686-pc-linux-gnu -analyzer-checker=security.insecureAPI,security.FloatLoopCounter %s -verify
+// RUN: %clang_analyze_cc1 -triple i686-pc-linux-gnu %s -verify \
+// RUN: -analyzer-checker=security.insecureAPI \
+// RUN: -analyzer-checker=security.FloatLoopCounter
+
// expected-no-diagnostics
// This file complements 'security-syntax-checks.m', but tests that we omit
Index: lib/StaticAnalyzer/Checkers/CheckSecuritySyntaxOnly.cpp
===================================================================
--- lib/StaticAnalyzer/Checkers/CheckSecuritySyntaxOnly.cpp
+++ lib/StaticAnalyzer/Checkers/CheckSecuritySyntaxOnly.cpp
@@ -740,7 +740,11 @@
// Issue a warning. ArgIndex == -1: Deprecated but not unsafe (has size
// restrictions).
enum { DEPR_ONLY = -1, UNKNOWN_CALL = -2 };
+
StringRef Name = FD->getIdentifier()->getName();
+ if (Name.startswith("__builtin_"))
+ Name = Name.substr(10);
+
int ArgIndex =
llvm::StringSwitch<int>(Name)
.Cases("scanf", "wscanf", "vscanf", "vwscanf", 0)
_______________________________________________
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
