llvmorg-github-actions[bot] wrote:
<!--LLVM PR SUMMARY COMMENT--> @llvm/pr-subscribers-clang-static-analyzer-1 Author: Benedek Kaibas (benedekaibas) <details> <summary>Changes</summary> In order to move the `DanglingPtrDeref` checker out of alpha it needs a documentation the user can get information from. This PR added the documentation for the `DanglingPtrDeref` checker and follow up PR will also do the same for the `UseAfterLifetimeEnd` checker. Currently the documentation sits in the `alpha.core` category, but once we move the checker out of alpha stage it should be changed as well. --- <sub>Stack created with <a href="https://github.com/github/gh-stack">GitHub Stacks CLI</a> • <a href="https://gh.io/stacks-feedback">Give Feedback 💬</a></sub> --- Full diff: https://github.com/llvm/llvm-project/pull/216688.diff 3 Files Affected: - (modified) clang/docs/analyzer/checkers.rst (+55) - (modified) clang/include/clang/StaticAnalyzer/Checkers/Checkers.td (+10-10) - (modified) clang/test/Analysis/dangling-ptr-deref.cpp (+1-1) ``````````diff diff --git a/clang/docs/analyzer/checkers.rst b/clang/docs/analyzer/checkers.rst index 1f6b974d5ca7a..5d43579a09eb6 100644 --- a/clang/docs/analyzer/checkers.rst +++ b/clang/docs/analyzer/checkers.rst @@ -3248,6 +3248,61 @@ Loss of sign/precision in implicit conversions. short X = A; // warn (loss of precision) } +.. _alpha-core-DanglingPtrDeref: + +alpha.core.DanglingPtrDeref (C, C++) +"""""""""""""""""""""""""""""""""""" +Check for dereferences of pointers that refer to an object whose +lifetime has already ended. Such a pointer is dangling. The checker +reports it when it is dereferenced and when it is passed to a function. + +Each object is reported at most once on an execution path. If the same dangling +pointer is used several times then only the first use is reported. + +.. code-block:: cpp + + void test_deref() { + int *ptr = 0; + { + int num = 5; + ptr = # + } // note: 'num' is destroyed here + *ptr = 6; // warn: use of 'num' after its lifetime ended + } + + void test_in_scope() { + int num = 5; + int *ptr = # + { + *ptr = 6; // no warning, 'num' is still in scope + } + } + +The checker requires end-of-lifetime information from the CFG. It is enabled +with the ``-analyzer-config cfg-lifetime=true`` option. + +**Limitations** + +If the analyzer does not inline the called function, for example because its +definition is not available in the given translation unit, then a dangling +pointer passed to it is reported even if the function would never dereference +it. This can lead to false positives. + +.. code-block:: cpp + + // The definition of the function is not available that is why the analyzer + // assumes the pointer is used. + int is_null(int *p); + + void argument_example() { + int *ptr = 0; + { + int num = 5; + ptr = # + } + is_null(ptr); // false positive: the pointer is compared, not dereferenced + } + .. _alpha-core-DynamicTypeChecker: alpha.core.DynamicTypeChecker (ObjC) diff --git a/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td b/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td index b6b3857dc7b35..3e6e7c9ea13d5 100644 --- a/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td +++ b/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td @@ -289,6 +289,16 @@ def StdVariantChecker : Checker<"StdVariant">, HelpText<"Check for bad type access for std::variant.">, Documentation<HasDocumentation>; +def LifetimeModeling : Checker<"LifetimeModeling">, + HelpText<"Model lifetime annotations for other checkers">, + Documentation<NotDocumented>, + Hidden; + +def DanglingPtrDeref : Checker<"DanglingPtrDeref">, + HelpText<"Check for dereferences of a dangling pointer">, + Dependencies<[LifetimeModeling]>, + Documentation<HasDocumentation>; + } // end "alpha.core" //===----------------------------------------------------------------------===// @@ -802,22 +812,12 @@ def SmartPtrChecker: Checker<"SmartPtr">, Dependencies<[SmartPtrModeling]>, Documentation<HasDocumentation>; -def LifetimeModeling : Checker<"LifetimeModeling">, - HelpText<"Model lifetime annotations for other checkers">, - Documentation<NotDocumented>, - Hidden; - def UseAfterLifetimeEnd : Checker<"UseAfterLifetimeEnd">, HelpText<"Check for uses of references or pointers that " "outlive their bound object">, Dependencies<[LifetimeModeling]>, Documentation<NotDocumented>; -def DanglingPtrDeref : Checker<"DanglingPtrDeref">, - HelpText<"Check for dereferences of a dangling pointer">, - Dependencies<[LifetimeModeling]>, - Documentation<NotDocumented>; - } // end: "alpha.cplusplus" //===----------------------------------------------------------------------===// diff --git a/clang/test/Analysis/dangling-ptr-deref.cpp b/clang/test/Analysis/dangling-ptr-deref.cpp index 55dd5eadc8ad0..8572b6416f150 100644 --- a/clang/test/Analysis/dangling-ptr-deref.cpp +++ b/clang/test/Analysis/dangling-ptr-deref.cpp @@ -1,4 +1,4 @@ -// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.cplusplus.DanglingPtrDeref \ +// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.core.DanglingPtrDeref \ // RUN: -analyzer-config cfg-lifetime=true -analyzer-output=text -verify %s void test_case_one() { `````````` </details> https://github.com/llvm/llvm-project/pull/216688 _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
