Alpha Checkers

+Experimental checkers in addition to the +Default Checkers. These are checkers with known issues or limitations that +keep them from being on by default. They are likely to have false positives. +Bug reports are welcome but will likely not be investigated for some time. +Patches welcome! +

Core Alpha Checkers
C++ Alpha Checkers
Dead Code Alpha Checkers
OS X Alpha Checkers
Security Alpha Checkers
Unix Alpha Checkers

+ + +

Core Alpha Checkers

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Name, Description	Example
+alpha.core.BoolAssignment +(ObjC) +Warn about assigning non-{0,1} values to boolean variables.	+ +void test() { + BOOL b = -1; // warn +} +
+alpha.core.CastSize +(C) +Check when casting a malloc'ed type T, whether the size is a multiple of the +size of T (Works only with unix.Malloc +or alpha.unix.MallocWithAnnotations +checks enabled).	+ +void test() { + int x = (int )malloc(11); // warn +} +
+alpha.core.CastToStruct +(C, C++) +Check for cast from non-struct pointer to struct pointer.	+ +// C +struct s {}; + +void test(int p) { + struct s ps = (struct s ) p; // warn +} + + +// C++ +class c {}; + +void test(int p) { + c pc = (c ) p; // warn +} +
+alpha.core.FixedAddr +(C) +Check for assignment of a fixed address to a pointer.	+ +void test() { + int p; + p = (int ) 0x10000; // warn +} +
+alpha.core.IdenticalExpr +(C, C++) +Warn about suspicious uses of identical expressions.	+ +// C +void test() { + int a = 5; + int b = a \| 4 \| a; // warn: identical expr on both sides +} + + +// C++ +bool f(void); + +void test(bool b) { + int i = 10; + if (f()) { // warn: true and false branches are identical + do { + i--; + } while (f()); + } else { + do { + i--; + } while (f()); + } +} +
+alpha.core.PointerArithm +(C) +Check for pointer arithmetic on locations other than array +elements.	+ +void test() { + int x; + int *p; + p = &x + 1; // warn +} +
+alpha.core.PointerSub +(C) +Check for pointer subtractions on two pointers pointing to different memory +chunks.	+ +void test() { + int x, y; + int d = &y - &x; // warn +} +
+alpha.core.SizeofPtr +(C) +Warn about unintended use of `sizeof()` on pointer +expressions.	+ +struct s {}; + +int test(struct s *p) { + return sizeof(p); + // warn: sizeof(ptr) can produce an unexpected result +} +

+ + +

C++ Alpha Checkers

+ + + + + + + + + + + + +

Name, Description	Example
+alpha.cplusplus.NewDeleteLeaks +(C++) +Check for memory leaks. Traces memory managed by `new`/`+delete`.	+ +void test() { + int *p = new int; +} // warn +
+alpha.cplusplus.VirtualCall +(C++) +Check virtual member function calls during construction or +destruction.	+ +class A { +public: + A() { + f(); // warn + } + virtual void f(); +}; + + +class A { +public: + ~A() { + this->f(); // warn + } + virtual void f(); +}; +

+ + +

Dead Code Alpha Checkers

+ + + + + + + +

Name, Description	Example
+alpha.deadcode.UnreachableCode +(C, C++, ObjC) +Check unreachable code.	+ +// C +int test() { + int x = 1; + while(x); + return x; // warn +} + + +// C++ +void test() { + int a = 2; + + while (a > 1) + a--; + + if (a > 1) + a++; // warn +} + + +// Objective-C +void test(id x) { + return; + [x retain]; // warn +} +

Name, Description

Example

+alpha.deadcode.UnreachableCode +(C, C++, ObjC)

+Check unreachable code.

+// C
+int test() {
+  int x = 1;
+  while(x);
+  return x; // warn
+}
+

+// C++
+void test() {
+  int a = 2;
+
+  while (a > 1)
+    a--;
+
+  if (a > 1)
+    a++; // warn
+}
+

+// Objective-C
+void test(id x) {
+  return;
+  [x retain]; // warn
+}
+

+ + +

OS X Alpha Checkers

+ + + + + + + + + + + + + + + + + + + + + + + + +

Name, Description	Example
+alpha.osx.cocoa.Dealloc +(ObjC) +Warn about Objective-C classes that lack a correct implementation +of `-dealloc`. +	+ +@interface MyObject : NSObject { + id _myproperty; +} +@end + +@implementation MyObject // warn: lacks 'dealloc' +@end + + +@interface MyObject : NSObject {} +@property(assign) id myproperty; +@end + +@implementation MyObject // warn: does not send 'dealloc' to super +- (void)dealloc { + self.myproperty = 0; +} +@end + + +@interface MyObject : NSObject { + id _myproperty; +} +@property(retain) id myproperty; +@end + +@implementation MyObject +@synthesize myproperty = _myproperty; + // warn: var was retained but wasn't released +- (void)dealloc { + [super dealloc]; +} +@end + + +@interface MyObject : NSObject { + id _myproperty; +} +@property(assign) id myproperty; +@end + +@implementation MyObject +@synthesize myproperty = _myproperty; + // warn: var wasn't retained but was released +- (void)dealloc { + [_myproperty release]; + [super dealloc]; +} +@end +
+alpha.osx.cocoa.DirectIvarAssignment +(ObjC) +Check that Objective C properties follow the following rule: the property +should be set with the setter, not though a direct assignment.	+ +@interface MyClass : NSObject {} +@property (readonly) id A; +- (void) foo; +@end + +@implementation MyClass +- (void) foo { + _A = 0; // warn +} +@end +
+alpha.osx.cocoa.DirectIvarAssignmentForAnnotatedFunctions +(ObjC) +Check for direct assignments to instance variables in the methods annotated +with `objc_no_direct_instance_variable_assignment`.	+ +@interface MyClass : NSObject {} +@property (readonly) id A; +- (void) fAnnotated __attribute__(( + annotate("objc_no_direct_instance_variable_assignment"))); +- (void) fNotAnnotated; +@end + +@implementation MyClass +- (void) fAnnotated { + _A = 0; // warn +} +- (void) fNotAnnotated { + _A = 0; // no warn +} +@end +
+alpha.osx.cocoa.InstanceVariableInvalidation +(ObjC) +Check that the invalidatable instance variables are invalidated in the methods +annotated with `objc_instance_variable_invalidator`.	+ +@protocol Invalidation <NSObject> +- (void) invalidate + __attribute__((annotate("objc_instance_variable_invalidator"))); +@end + +@interface InvalidationImpObj : NSObject <Invalidation> +@end + +@interface SubclassInvalidationImpObj : InvalidationImpObj { + InvalidationImpObj *var; +} +- (void)invalidate; +@end + +@implementation SubclassInvalidationImpObj +- (void) invalidate {} +@end +// warn: var needs to be invalidated or set to nil +
+alpha.osx.cocoa.MissingInvalidationMethod +(ObjC) +Check that the invalidation methods are present in classes that contain +invalidatable instance variables.	+ +@protocol Invalidation <NSObject> +- (void)invalidate + __attribute__((annotate("objc_instance_variable_invalidator"))); +@end + +@interface NeedInvalidation : NSObject <Invalidation> +@end + +@interface MissingInvalidationMethodDecl : NSObject { + NeedInvalidation *Var; // warn +} +@end + +@implementation MissingInvalidationMethodDecl +@end +

+ + +

Security Alpha Checkers

+ + + + + + + + + + + + + + + + + + + + + + + + +

Name, Description	Example
+alpha.security.ArrayBound +(C) +Warn about buffer overflows (older checker).	+ +void test() { + char s = ""; + char c = s[1]; // warn +} + + +struct seven_words { + int c[7]; +}; + +void test() { + struct seven_words a, p; + p = &a; + p[0] = a; + p[1] = a; + p[2] = a; // warn +} + + +// note: requires unix.Malloc or +// alpha.unix.MallocWithAnnotations checks enabled. +void test() { + int p = malloc(12); + p[3] = 4; // warn +} + + +void test() { + char a[2]; + int b = (int*)a; + b[1] = 3; // warn +} +
+alpha.security.ArrayBoundV2 +(C) +Warn about buffer overflows (newer checker).	+ +void test() { + char s = ""; + char c = s[1]; // warn +} + + +void test() { + int buf[100]; + int p = buf; + p = p + 99; + p[1] = 1; // warn +} + + +// note: compiler has internal check for this. +// Use -Wno-array-bounds to suppress compiler warning. +void test() { + int buf[100][100]; + buf[0][-1] = 1; // warn +} + + +// note: requires alpha.security.taint check turned on. +void test() { + char s[] = "abc"; + int x = getchar(); + char c = s[x]; // warn: index is tainted +} +
+alpha.security.MallocOverflow +(C) +Check for overflows in the arguments to `malloc()`.	+ +void test(int n) { + void p = malloc(n sizeof(int)); // warn +} +
+alpha.security.ReturnPtrRange +(C) +Check for an out-of-bound pointer being returned to callers.	+ +static int A[10]; + +int test() { + int p = A + 10; + return p; // warn +} + + +int test(void) { + int x; + return x; // warn: undefined or garbage returned +} +
+alpha.security.taint.TaintPropagation +(C) +Generate taint information used by other checkers.	+ +void test() { + char x = getchar(); // 'x' marked as tainted + system(&x); // warn: untrusted data is passed to a system call +} + + +// note: compiler internally checks if the second param to +// sprintf is a string literal or not. +// Use -Wno-format-security to suppress compiler warning. +void test() { + char s[10], buf[10]; + fscanf(stdin, "%s", s); // 's' marked as tainted + + sprintf(buf, s); // warn: untrusted data as a format string +} + + +void test() { + size_t ts; + scanf("%zd", &ts); // 'ts' marked as tainted + int p = (int )malloc(ts * sizeof(int)); + // warn: untrusted data as bufer size +} +

+ + +

Unix Alpha Checkers

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Name, Description	Example
+alpha.unix.Chroot +(C) +Check improper use of `chroot`.	+ +void f(); + +void test() { + chroot("/usr/local"); + f(); // warn: no call of chdir("/") immediately after chroot +} +
+alpha.unix.MallocWithAnnotations +(C) +Check for memory leaks, double free, and use-after-free problems. Assumes that +all user-defined functions which might free a pointer are +annotated.	+ +void __attribute((ownership_returns(malloc))) my_malloc(size_t); + +void test() { + int p = my_malloc(1); +} // warn: potential leak + + +void __attribute((ownership_returns(malloc))) my_malloc(size_t); +void __attribute((ownership_takes(malloc, 1))) my_free(void ); + +void test() { + int p = my_malloc(1); + my_free(p); + my_free(p); // warn: attempt to free released +} + + +void __attribute((ownership_returns(malloc))) my_malloc(size_t); +void __attribute((ownership_holds(malloc, 1))) my_hold(void ); + +void test() { + int p = my_malloc(1); + my_hold(p); + free(p); // warn: attempt to free non-owned memory +} + + +void __attribute((ownership_takes(malloc, 1))) my_free(void ); + +void test() { + int p = malloc(1); + my_free(p); + *p = 1; // warn: use after free +} +
+alpha.unix.PthreadLock +(C) +Simple lock -> unlock checker; applies to: +pthread_mutex_lock +pthread_rwlock_rdlock +pthread_rwlock_wrlock +lck_mtx_lock +lck_rw_lock_exclusive +lck_rw_lock_shared +pthread_mutex_trylock +pthread_rwlock_tryrdlock +pthread_rwlock_tryrwlock +lck_mtx_try_lock +lck_rw_try_lock_exclusive +lck_rw_try_lock_shared +pthread_mutex_unlock +pthread_rwlock_unlock +lck_mtx_unlock +lck_rw_done	+ +pthread_mutex_t mtx; + +void test() { + pthread_mutex_lock(&mtx); + pthread_mutex_lock(&mtx); + // warn: this lock has already been acquired +} + + +lck_mtx_t lck1, lck2; + +void test() { + lck_mtx_lock(&lck1); + lck_mtx_lock(&lck2); + lck_mtx_unlock(&lck1); + // warn: this was not the most recently acquired lock +} + + +lck_mtx_t lck1, lck2; + +void test() { + if (lck_mtx_try_lock(&lck1) == 0) + return; + + lck_mtx_lock(&lck2); + lck_mtx_unlock(&lck1); + // warn: this was not the most recently acquired lock +} +
+alpha.unix.SimpleStream +(C) +Check for misuses of stream APIs: +fopen +fclose (demo checker, the subject of the demo +(Slides +,Video) +by Anna Zaks and Jordan Rose presented at the +2012 LLVM Developers' Meeting).	+ +void test() { + FILE F = fopen("myfile.txt", "w"); +} // warn: opened file is never closed + + +void test() { + FILE F = fopen("myfile.txt", "w"); + + if (F) + fclose(F); + + fclose(F); // warn: closing a previously closed file stream +} +
+alpha.unix.Stream +(C) +Check stream handling functions: fopen +tmpfile +fclose +fread +fwrite +fseek +ftell +rewind +fgetpos +fsetpos +clearerr +feof +ferror +fileno	+ +void test() { + FILE p = fopen("foo", "r"); +} // warn: opened file is never closed + + +void test() { + FILE p = fopen("foo", "r"); + fseek(p, 1, SEEK_SET); // warn: stream pointer might be NULL + fclose(p); +} + + +void test() { + FILE p = fopen("foo", "r"); + + if (p) + fseek(p, 1, 3); + // warn: third arg should be SEEK_SET, SEEK_END, or SEEK_CUR + + fclose(p); +} + + +void test() { + FILE p = fopen("foo", "r"); + fclose(p); + fclose(p); // warn: already closed +} + + +void test() { + FILE *p = tmpfile(); + ftell(p); // warn: stream pointer might be NULL + fclose(p); +} +
+alpha.unix.cstring.BufferOverlap +(C) +Checks for overlap in two buffer arguments; applies to: +memcpy +mempcpy	+ +void test() { + int a[4] = {0}; + memcpy(a + 2, a + 1, 8); // warn +} +
+alpha.unix.cstring.NotNullTerminated +(C) +Check for arguments which are not null-terminated strings; applies +to: +strlen +strnlen +strcpy +strncpy +strcat +strncat	+ +void test() { + int y = strlen((char *)&test); // warn +} +
+alpha.unix.cstring.OutOfBounds +(C) +Check for out-of-bounds access in string functions; applies +to: +strncopy +strncat	+ +void test(char *y) { + char x[4]; + if (strlen(y) == 4) + strncpy(x, y, 5); // warn +} +

+ +

Implicit Checkers

Default Checkers

Experimental (Alpha) Checkers

Core Implicit Checkers

Name, Description

Example

+core.DynamicTypePropagation +(C++, ObjC)

+Generate dynamic type information.

+// C++
+class A {
+public:
+  A(int x) {}
+  virtual int foo();
+};
+
+class B: public A {
+public:
+  B()
+  :A(foo()) 
+  // DynamicTypeInfo for 'this' rigion will wrap type 'A'
+  // unless the base constructor call expression is processed
+  {} 
+  virtual int foo();
+};
+

+// Objective-C
+@interface MyClass : NSObject {}
+@end
+
+@implementation MyClass
++ (void)foo {
+  MyClass *x = [[self alloc] init];
+  // DynamicTypeInfo from a cast: from 'id' to 'MyClass *'
+}
+@end
+
+void test() {
+  MyClass *x = [MyClass alloc];
+  // DynamicTypeInfo from a call to alloc:
+  // from 'id' to 'MyClass *'
+}
+

+core.builtin.BuiltinFunctions +(C)

+Evaluate compiler builtin functions (e.g., alloca())

+void test(int x) {
+  int *p = (int *)__builtin_alloca(8);
+    // evaluates to AllocaRegion
+
+  if(__builtin_expect(x > 10, 0)) // evaluates to 'x > 10'
+    x = 0;
+}
+

+core.builtin.NoReturnFunctions +(C, ObjC)

+Evaluate "panic" functions that are known to not return to the caller.

+// C
+void test() {
+  panic(); // generate sink
+}
+

+// Objective-C
+@interface MyObj : NSObject {}
+- (void)foo;
+@end
+
+@implementation MyObj
+- (void)foo {
+  [[NSAssertionHandler currentHandler] handleFailureInMethod:_cmd 
+                                       object:self 
+                                       file:(@"somefile.m") 
+                                       lineNumber:1 
+                                       description:(@"some text")];
+    // generate sink
+}
+@end
+

OS X Implicit Checkers

Name, Description

Example

+osx.cocoa.Loops +(ObjC)

+Improved modeling of loops using Cocoa collection types.

+void test() {
+  id x;
+  for (x in [NSArray testObject]) { 
+    // assume the value of 'x' is non-nil
+  }
+}
+

+osx.cocoa.NonNilReturnValue +(ObjC)

+Model the APIs that are guaranteed to return a non-nil value.

+void test(NSArray *A) {
+  id subscriptObj = A[1]; // assume the value is non-nil
+}
+

Alpha Checkers

Core Alpha Checkers

C++ Alpha Checkers

Dead Code Alpha Checkers

OS X Alpha Checkers

Security Alpha Checkers

Unix Alpha Checkers

Core Checkers

C++ Checkers

Dead Code Checkers

OS X Checkers

Security Checkers

Unix Checkers

Getting Started

Useful Links

Implicit Checkers

Core Implicit Checkers

OS X Implicit Checkers