From ad3273be3cd7dd465d38d43aedbf069f7770bb92 Mon Sep 17 00:00:00 2001 From: Jordan Rose Date: Sat, 10 Aug 2013 01:24:35 +0000 Subject: [PATCH] [analyzer] Update Open Projects and Potential Checkers pages. - va_list checker (PR16811 and PR16812) - Model floating-point values - Bound bitwise masking operations (PR16615) - Bound C string length (PR16558 and others) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@188127 91177308-0d34-0410-b5e6-96231b3b80d8 --- www/analyzer/open_projects.html | 22 ++++++++++++++- www/analyzer/potential_checkers.html | 40 ++++++++++++++++++++++++++++ 2 files changed, 61 insertions(+), 1 deletion(-) diff --git a/www/analyzer/open_projects.html b/www/analyzer/open_projects.html index c015b48665..a5f5538662 100644 --- a/www/analyzer/open_projects.html +++ b/www/analyzer/open_projects.html @@ -31,7 +31,17 @@ mailing list to notify other members of the community.

not available during analysis. Modeling more of the widely used functions (such as the members of std::string) will improve precision of the analysis. - (Difficulty: Easy)

+ (Difficulty: Easy, ongoing)

+ + +

  • Handle floating-point values. +

    Currently, the analyzer treats all floating-point values as unknown. + However, we already have most of the infrastructure we need to handle + floats: RangeConstraintManager. This would involve adding a new SVal kind + for constant floats, generalizing the constraint manager to handle floats + and integers equally, and auditing existing code to make sure it doesn't + make untoward assumptions. + (Difficulty: Medium)

  • Implement generalized loop execution modeling. @@ -159,6 +169,16 @@ mailing list to notify other members of the community.

    (Difficulty: Easy)

    • +
  • Implement a BitwiseMaskingChecker to handle PR16615. +

    Symbolic expressions of the form $sym & CONSTANT can range from 0 to CONSTANT-1 if CONSTANT is 2^n-1, e.g. 0xFF (0b11111111), 0x7F (0b01111111), 0x3 (0b0011), 0xFFFF, etc. Even without handling general bitwise operations on symbols, we can at least bound the value of the resulting expression. Bonus points for handling masks followed by shifts, e.g. ($sym & 0b1100) >> 2. + (Difficulty: Easy)

    +
    • + +
  • Teach CStringChecker that strings are never longer than, say, SIZE_MAX/4 characters.
    • +

    Though most of CStringChecker's functionality is disabled (due to poor diagnostics for error edge cases), it's still used to model certain operations like strlen, which should give the same result each time it's called on a string. However, assuming that the string length is an arbitrary symbolic value can give strange results -- for example, strlen(str)+1 could wrap around to 0. (This is the root cause of PR16558.) In practice, strings are never that long, so picking some large upper bound and recording that in the state would make plenty of sense, and would fix these false positives. + (Difficulty: Easy)

    + +
  • Implement iterators invalidation checker.

    (Difficulty: Easy)

    • diff --git a/www/analyzer/potential_checkers.html b/www/analyzer/potential_checkers.html index c769541e70..6b96d1339c 100644 --- a/www/analyzer/potential_checkers.html +++ b/www/analyzer/potential_checkers.html @@ -183,6 +183,46 @@ void test(A *dst, A *src) { + +

    va_list

    + ++ + + + + + +
    Name, DescriptionExampleProgress
    valist.Uninitialized

    +Calls to the va_arg, va_copy, or +va_end macro must happen after calling va_start and +before calling va_end. +
    +#include <stdarg.h>
+
+void test(int x, ...) {
+  va_list args;
+  int y = va_arg(args, int); // warn
+  va_start(args, x); 
+  va_end(args, x);
+  int z = va_arg(args, int); // warn
+}
+
    		PR16811
    valist.Unterminated

    +Every va_start must be matched by a va_end. A va_list +can only be ended once. + +This should be folded into the generalized "ownership checker" described on the Open Projects page. +
    +#include <stdarg.h>
+
+void test(int x, ...) {
+  va_list args;
+  va_start(args, x);
+  int y = x + va_arg(args, int);
+  // missing va_end
+}
+
    		PR16812
    +

    exceptions

    -- 2.40.0