[clang] [clang][analyzer] Move checker alpha.unix.StdCLibraryFunctions out of alpha. (PR #66207)

2023-09-29 Thread Balazs Benics via cfe-commits
https://github.com/steakhal edited https://github.com/llvm/llvm-project/pull/66207 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [clang][analyzer] Move checker alpha.unix.StdCLibraryFunctions out of alpha. (PR #66207)

2023-09-29 Thread Balazs Benics via cfe-commits
https://github.com/steakhal approved this pull request. I didn't spent much time on this, but I think it should be good. Please check the docs with Grammarly to catch mistakes. Also, please generate the HTML for the rst to verify how it looks. I'm not sure if the release docs mentions this, but

[clang] [clang][analyzer] Move checker alpha.unix.StdCLibraryFunctions out of alpha. (PR #66207)

2023-09-29 Thread Balazs Benics via cfe-commits
@@ -1026,6 +1026,100 @@ Check for null pointers being passed as arguments to C string functions: return strlen(0); // warn } +.. _unix-StdCLibraryFunctions: + +unix.StdCLibraryFunctions (C) +""" +Check for calls of standard library function

[clang] [clang][analyzer] Move checker alpha.unix.StdCLibraryFunctions out of alpha. (PR #66207)

2023-09-29 Thread Balazs Benics via cfe-commits
@@ -1026,6 +1026,100 @@ Check for null pointers being passed as arguments to C string functions: return strlen(0); // warn } +.. _unix-StdCLibraryFunctions: + +unix.StdCLibraryFunctions (C) +""" +Check for calls of standard library function

[clang] [clang][analyzer] Move checker alpha.unix.StdCLibraryFunctions out of alpha. (PR #66207)

2023-09-29 Thread Balazs Benics via cfe-commits
@@ -2651,100 +2745,6 @@ For a more detailed description of configuration options, please see the alpha.unix ^^^ steakhal wrote: As we are here, could you align this with its section title as well? https://github.com/llvm/llvm-project/pull/66207 __

[clang] [clang][analyzer] Move checker alpha.unix.StdCLibraryFunctions out of alpha. (PR #66207)

2023-09-29 Thread Balazs Benics via cfe-commits
@@ -1026,6 +1026,100 @@ Check for null pointers being passed as arguments to C string functions: return strlen(0); // warn } +.. _unix-StdCLibraryFunctions: + +unix.StdCLibraryFunctions (C) +""" steakhal wrote: Align this

[clang] [clang][analyzer] Move checker alpha.unix.StdCLibraryFunctions out of alpha. (PR #66207)

2023-09-29 Thread Balazs Benics via cfe-commits
@@ -1026,6 +1026,100 @@ Check for null pointers being passed as arguments to C string functions: return strlen(0); // warn } +.. _unix-StdCLibraryFunctions: + +unix.StdCLibraryFunctions (C) +""" +Check for calls of standard library function

[clang] [clang][analyzer] Move checker alpha.unix.StdCLibraryFunctions out of alpha. (PR #66207)

2023-09-29 Thread Balazs Benics via cfe-commits
@@ -1026,6 +1026,100 @@ Check for null pointers being passed as arguments to C string functions: return strlen(0); // warn } +.. _unix-StdCLibraryFunctions: + +unix.StdCLibraryFunctions (C) +""" +Check for calls of standard library function

[clang] [clang][analyzer] Move checker alpha.unix.StdCLibraryFunctions out of alpha. (PR #66207)

2023-09-29 Thread Balazs Benics via cfe-commits
@@ -532,6 +532,27 @@ def MismatchedDeallocatorChecker : Checker<"MismatchedDeallocator">, Dependencies<[DynamicMemoryModeling]>, Documentation; +def StdCLibraryFunctionsChecker : Checker<"StdCLibraryFunctions">, + HelpText<"Check for invalid arguments of C standard libra

[clang] [analyzer][NFC] Simplifications in ArrayBoundV2 (PR #67572)

2023-09-29 Thread Balazs Benics via cfe-commits
steakhal wrote: I remember I looked this once. I postponed my comments because I was expecting some numbers or confirmation of that this patch is indeed NFC, thus no report or notes change. I'm not sure if this actually holds, given the changes, but let me know in any case. BTW I'm fine with

[clang] [analyzer][NFC] Simplifications in ArrayBoundV2 (PR #67572)

2023-09-29 Thread Balazs Benics via cfe-commits
steakhal wrote: > I'm confident that this patch is NFC, but my claim is based on theoretical > reasoning (a.k.a. "I think I didn't make a mistake"). I have a background in > theoretical mathematics, so for me "I have a rough a proof in my head" is > intuitively stronger than "I verified it on

[clang] 862b93a - [analyzer][docs] Add CSA release notes

2023-07-23 Thread Balazs Benics via cfe-commits
Author: Balazs Benics Date: 2023-07-24T08:26:54+02:00 New Revision: 862b93a8095cd350d8b398f03dca92b93002f984 URL: https://github.com/llvm/llvm-project/commit/862b93a8095cd350d8b398f03dca92b93002f984 DIFF: https://github.com/llvm/llvm-project/commit/862b93a8095cd350d8b398f03dca92b93002f984.diff

[clang] [analyzer] Trust base to derived casts for dynamic types (PR #69057)

2023-10-14 Thread Balazs Benics via cfe-commits
https://github.com/steakhal created https://github.com/llvm/llvm-project/pull/69057 When doing a base to derived cast, and we should add a cast info recording that fact. This information will be then used for example inside `CXXInstanceCall::getRuntimeDefinition` (CallEvent.cpp), where for vir

[clang] [analyzer][NFC] Simplifications in ArrayBoundV2 (PR #67572)

2023-10-15 Thread Balazs Benics via cfe-commits
https://github.com/steakhal requested changes to this pull request. https://github.com/llvm/llvm-project/pull/67572 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer][NFC] Simplifications in ArrayBoundV2 (PR #67572)

2023-10-15 Thread Balazs Benics via cfe-commits
https://github.com/steakhal edited https://github.com/llvm/llvm-project/pull/67572 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer][NFC] Simplifications in ArrayBoundV2 (PR #67572)

2023-10-15 Thread Balazs Benics via cfe-commits
@@ -32,42 +32,72 @@ using namespace taint; namespace { class ArrayBoundCheckerV2 : public Checker { - mutable std::unique_ptr BT; - mutable std::unique_ptr TaintBT; + BugType BT{this, "Out-of-bound access"}; + BugType TaintBT{this, "Out-of-bound access", categories::Tai

[clang] [analyzer][NFC] Simplifications in ArrayBoundV2 (PR #67572)

2023-10-15 Thread Balazs Benics via cfe-commits
@@ -32,42 +32,72 @@ using namespace taint; namespace { class ArrayBoundCheckerV2 : public Checker { - mutable std::unique_ptr BT; - mutable std::unique_ptr TaintBT; + BugType BT{this, "Out-of-bound access"}; + BugType TaintBT{this, "Out-of-bound access", categories::Tai

[clang] [analyzer][NFC] Simplifications in ArrayBoundV2 (PR #67572)

2023-10-15 Thread Balazs Benics via cfe-commits
@@ -32,42 +32,72 @@ using namespace taint; namespace { class ArrayBoundCheckerV2 : public Checker { - mutable std::unique_ptr BT; - mutable std::unique_ptr TaintBT; + BugType BT{this, "Out-of-bound access"}; + BugType TaintBT{this, "Out-of-bound access", categories::Tai

[clang] [analyzer][NFC] Simplifications in ArrayBoundV2 (PR #67572)

2023-10-15 Thread Balazs Benics via cfe-commits
@@ -32,42 +32,72 @@ using namespace taint; namespace { class ArrayBoundCheckerV2 : public Checker { - mutable std::unique_ptr BT; - mutable std::unique_ptr TaintBT; + BugType BT{this, "Out-of-bound access"}; + BugType TaintBT{this, "Out-of-bound access", categories::Tai

[clang] [analyzer] Fix note for member reference (PR #68691)

2023-10-15 Thread Balazs Benics via cfe-commits
=?utf-8?q?G=C3=A1bor?= Spaits,=?utf-8?q?G=C3=A1bor?= Spaits, =?utf-8?q?G=C3=A1bor?= Spaits Message-ID: In-Reply-To: https://github.com/steakhal approved this pull request. https://github.com/llvm/llvm-project/pull/68691 ___ cfe-commits mailing list c

[clang] [analyzer][NFC] Remove outdated FIXME comment (PR #68211)

2023-10-15 Thread Balazs Benics via cfe-commits
https://github.com/steakhal commented: LGTM Thanks. https://github.com/llvm/llvm-project/pull/68211 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Trust base to derived casts for dynamic types (PR #69057)

2023-10-16 Thread Balazs Benics via cfe-commits
@@ -0,0 +1,105 @@ +// RUN: %clang_analyze_cc1 %s -verify \ +// RUN: -analyzer-checker=core \ +// RUN: -analyzer-checker=alpha.security.taint.TaintPropagation \ +// RUN: -analyzer-checker=debug.ExprInspection + +// See issue https://github.com/llvm/llvm-project/issues/62663 +

[clang] [analyzer] Trust base to derived casts for dynamic types (PR #69057)

2023-10-16 Thread Balazs Benics via cfe-commits
https://github.com/steakhal updated https://github.com/llvm/llvm-project/pull/69057 >From 8ed4effd114ebd83d4ceaa37655ffd9b7105b28e Mon Sep 17 00:00:00 2001 From: Balazs Benics Date: Sat, 14 Oct 2023 15:51:42 +0200 Subject: [PATCH 1/3] [analyzer] Trust base to derived casts for dynamic types Wh

[clang] [analyzer] Trust base to derived casts for dynamic types (PR #69057)

2023-10-16 Thread Balazs Benics via cfe-commits
https://github.com/steakhal updated https://github.com/llvm/llvm-project/pull/69057 >From 8ed4effd114ebd83d4ceaa37655ffd9b7105b28e Mon Sep 17 00:00:00 2001 From: Balazs Benics Date: Sat, 14 Oct 2023 15:51:42 +0200 Subject: [PATCH 1/4] [analyzer] Trust base to derived casts for dynamic types Wh

[clang] [analyzer] Trust base to derived casts for dynamic types (PR #69057)

2023-10-16 Thread Balazs Benics via cfe-commits
@@ -392,19 +393,26 @@ void DynamicTypePropagation::checkPostCall(const CallEvent &Call, } } -/// TODO: Handle explicit casts. -/// Handle C++ casts. -/// -/// Precondition: the cast is between ObjCObjectPointers. ExplodedNode *DynamicTypePropagation::dynamicTypePropa

[clang] [analyzer] Trust base to derived casts for dynamic types (PR #69057)

2023-10-16 Thread Balazs Benics via cfe-commits
@@ -392,19 +393,26 @@ void DynamicTypePropagation::checkPostCall(const CallEvent &Call, } } -/// TODO: Handle explicit casts. -/// Handle C++ casts. -/// -/// Precondition: the cast is between ObjCObjectPointers. ExplodedNode *DynamicTypePropagation::dynamicTypePropa

[clang] [analyzer] Trust base to derived casts for dynamic types (PR #69057)

2023-10-16 Thread Balazs Benics via cfe-commits
@@ -609,9 +617,13 @@ storeWhenMoreInformative(ProgramStateRef &State, SymbolRef Sym, /// symbol and the destination type of the cast are unrelated, report an error. void DynamicTypePropagation::checkPostStmt(const CastExpr *CE, Checke

[clang] e73ae74 - [analyzer] Fix incorrect link to "note" diagnostics in HTML output

2023-08-03 Thread Balazs Benics via cfe-commits
Author: Guruprasad Hegde Date: 2023-08-03T11:44:05+02:00 New Revision: e73ae745b0d660d3974c04b2281575f325971338 URL: https://github.com/llvm/llvm-project/commit/e73ae745b0d660d3974c04b2281575f325971338 DIFF: https://github.com/llvm/llvm-project/commit/e73ae745b0d660d3974c04b2281575f325971338.di

[clang] [analyzer] Reduce constraint on modulo with small concrete range (PR #65448)

2023-09-08 Thread Balazs Benics via cfe-commits
https://github.com/steakhal commented: In 1 minute it makes sense. Will need a thorough evaluation. I'll review this properly once I'm back from vacation. https://github.com/llvm/llvm-project/pull/65448 ___ cfe-commits mailing list cfe-commits@lists.ll

[clang] [analyzer] Do not use APInt methods on _BitInt() Types (PR #65887)

2023-09-10 Thread Balazs Benics via cfe-commits
steakhal wrote: I guess this is one sideeffect of `getZExtValue` and `getSExtValue`. To me, it feels like all such calls could hit the same assert, thus it fixes this instance, but we still lack a generic solution to this problem at other places. I'm not opposing to this fix, but it might make

[clang] c3a87dd - [analyzer] CStringChecker should check the first byte of the destination of strcpy, strncpy

2023-09-11 Thread Balazs Benics via cfe-commits
Author: Balazs Benics Date: 2023-09-11T14:19:33+02:00 New Revision: c3a87ddad62a6cc01acaccc76592bc6730c8ac3c URL: https://github.com/llvm/llvm-project/commit/c3a87ddad62a6cc01acaccc76592bc6730c8ac3c DIFF: https://github.com/llvm/llvm-project/commit/c3a87ddad62a6cc01acaccc76592bc6730c8ac3c.diff

[clang] 0954dc3 - [analyzer] CStringChecker buffer access checks should check the first bytes

2023-09-11 Thread Balazs Benics via cfe-commits
Author: Balazs Benics Date: 2023-09-11T14:19:33+02:00 New Revision: 0954dc3fb9214b994623f5306473de075f8e3593 URL: https://github.com/llvm/llvm-project/commit/0954dc3fb9214b994623f5306473de075f8e3593 DIFF: https://github.com/llvm/llvm-project/commit/0954dc3fb9214b994623f5306473de075f8e3593.diff

[clang] 706afc9 - Fixup "[analyzer] CStringChecker buffer access checks should check the first bytes"

2023-09-11 Thread Balazs Benics via cfe-commits
Author: Balazs Benics Date: 2023-09-11T15:01:22+02:00 New Revision: 706afc9778827dfd8064192c26acd0bc1c421e48 URL: https://github.com/llvm/llvm-project/commit/706afc9778827dfd8064192c26acd0bc1c421e48 DIFF: https://github.com/llvm/llvm-project/commit/706afc9778827dfd8064192c26acd0bc1c421e48.diff

[clang] First batch of patches for the Juliet benchmark for taint improvements (PR #66074)

2023-09-12 Thread Balazs Benics via cfe-commits
https://github.com/steakhal created https://github.com/llvm/llvm-project/pull/66074: See the motivation here: https://discourse.llvm.org/t/patches-inspired-by-the-juliet-benchmark/73106 I've checked all these 4 commits on a large set of projects, and they - surprisingly - don't show any repor

[clang] First batch of patches for the Juliet benchmark for taint improvements (PR #66074)

2023-09-12 Thread Balazs Benics via cfe-commits
https://github.com/steakhal review_requested https://github.com/llvm/llvm-project/pull/66074 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] First batch of patches for the Juliet benchmark for taint improvements (PR #66074)

2023-09-12 Thread Balazs Benics via cfe-commits
https://github.com/steakhal review_requested https://github.com/llvm/llvm-project/pull/66074 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] First batch of patches for the Juliet benchmark for taint improvements (PR #66074)

2023-09-12 Thread Balazs Benics via cfe-commits
https://github.com/steakhal labeled https://github.com/llvm/llvm-project/pull/66074 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] First batch of patches for the Juliet benchmark for taint improvements (PR #66074)

2023-09-12 Thread Balazs Benics via cfe-commits
https://github.com/steakhal unlabeled https://github.com/llvm/llvm-project/pull/66074 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] First batch of patches for the Juliet benchmark for taint improvements (PR #66074)

2023-09-12 Thread Balazs Benics via cfe-commits
https://github.com/steakhal edited https://github.com/llvm/llvm-project/pull/66074 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] First batch of patches for the Juliet benchmark for taint improvements (PR #66074)

2023-09-12 Thread Balazs Benics via cfe-commits
https://github.com/steakhal edited https://github.com/llvm/llvm-project/pull/66074 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] First batch of patches for the Juliet benchmark for taint improvements (PR #66074)

2023-09-12 Thread Balazs Benics via cfe-commits
@@ -105,7 +105,8 @@ bool isStdin(SVal Val, const ASTContext &ACtx) { if (const auto *D = dyn_cast_or_null(DeclReg->getDecl())) { D = D->getCanonicalDecl(); // FIXME: This should look for an exact match. -if (D->getName().contains("stdin") && D->isExternC()) { +

[clang] [analyzer] First batch of patches for the Juliet benchmark for taint improvements (PR #66074)

2023-09-12 Thread Balazs Benics via cfe-commits
steakhal wrote: > These are small and straightforward improvements, they mostly LGTM. > > Note that in the commit message of "[[analyzer] Fix stdin declaration in C++ > tests](https://github.com/llvm/llvm-project/pull/66074/commits/ededc22487a23a7deaa971526da8a932ea27b231)" > the first line co

[clang] [analyzer] First batch of patches for the Juliet benchmark for taint improvements (PR #66074)

2023-09-12 Thread Balazs Benics via cfe-commits
https://github.com/steakhal updated https://github.com/llvm/llvm-project/pull/66074: >From 13677c9acfbadd82d9e008339a65d86adc87e1ff Mon Sep 17 00:00:00 2001 From: Balazs Benics Date: Tue, 12 Sep 2023 14:00:33 +0200 Subject: [PATCH 1/3] [analyzer] Fix stdin declaration in C++ tests The `stdin`

[clang] [analyzer] First batch of patches for the Juliet benchmark for taint improvements (PR #66074)

2023-09-12 Thread Balazs Benics via cfe-commits
https://github.com/steakhal edited https://github.com/llvm/llvm-project/pull/66074 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] First batch of patches for the Juliet benchmark for taint improvements (PR #66074)

2023-09-12 Thread Balazs Benics via cfe-commits
@@ -105,7 +105,8 @@ bool isStdin(SVal Val, const ASTContext &ACtx) { if (const auto *D = dyn_cast_or_null(DeclReg->getDecl())) { D = D->getCanonicalDecl(); // FIXME: This should look for an exact match. -if (D->getName().contains("stdin") && D->isExternC()) { +

[clang] [analyzer] First batch of patches for the Juliet benchmark for taint improvements (PR #66074)

2023-09-12 Thread Balazs Benics via cfe-commits
https://github.com/steakhal resolved https://github.com/llvm/llvm-project/pull/66074 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] First batch of patches for the Juliet benchmark for taint improvements (PR #66074)

2023-09-12 Thread Balazs Benics via cfe-commits
steakhal wrote: Sorry about the force push, but it was necessary to split off the `Fix taint sink rules for exec-like functions` commit from this PR. - I addressed the typos (I hope). - Using equality for checking against `stdint` instead of `contains`. - Fixed the build bots, because I forgo

[clang] [analyzer] First batch of patches for the Juliet benchmark for taint improvements (PR #66074)

2023-09-12 Thread Balazs Benics via cfe-commits
https://github.com/steakhal review_requested https://github.com/llvm/llvm-project/pull/66074 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] First batch of patches for the Juliet benchmark for taint improvements (PR #66074)

2023-09-12 Thread Balazs Benics via cfe-commits
steakhal wrote: > I'll re-run the measurement to ensure everything is all right. Yup, no report changes. Confirmed. https://github.com/llvm/llvm-project/pull/66074 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/

[clang] [analyzer] Fix StdLibraryFunctionsChecker crash on surprising sink node (PR #66109)

2023-09-13 Thread Balazs Benics via cfe-commits
https://github.com/steakhal approved this pull request. I don't think it deserves a fragile test case. I think the fix looks good. I also agree with your other statements on the addTransition subject. https://github.com/llvm/llvm-project/pull/66109 ___

[clang] [analyzer] TaintPropagation checker strlen() should not propagate (PR #66086)

2023-09-13 Thread Balazs Benics via cfe-commits
steakhal wrote: I can understand the frustration of the FPs. However, propagating taint there is the right thing to do. To me, the fault is on the diagnostic on the malloc. Those are the cause of the FPs, thus that needs to be removed instead of the propagation. I have this opinion even if the

[clang] [analyzer] TaintPropagation checker strlen() should not propagate (PR #66086)

2023-09-13 Thread Balazs Benics via cfe-commits
steakhal wrote: I actually wanted to propose another patch where the wchar variant of strlen would propagate taint, BTW. I still plan to do it, we will see when I reach that. https://github.com/llvm/llvm-project/pull/66086 ___ cfe-commits mailing lis

[clang] [analyzer] TaintPropagation checker strlen() should not propagate (PR #66086)

2023-09-14 Thread Balazs Benics via cfe-commits
steakhal wrote: I finished the review of this PR. By looking at the disappeared reports you attached, I'm convinced that the `MsgTaintedBufferSize` diagnostics give little to no benefit in general. On the other side, I've seen good hits for OOBV2 in the presence of taint - even if that's rare

[clang] [analyzer] TaintPropagation checker strlen() should not propagate (PR #66086)

2023-09-14 Thread Balazs Benics via cfe-commits
https://github.com/steakhal requested changes to this pull request. https://github.com/llvm/llvm-project/pull/66086 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] TaintPropagation checker strlen() should not propagate (PR #66086)

2023-09-14 Thread Balazs Benics via cfe-commits
https://github.com/steakhal edited https://github.com/llvm/llvm-project/pull/66086 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] TaintPropagation checker strlen() should not propagate (PR #66086)

2023-09-14 Thread Balazs Benics via cfe-commits
@@ -915,24 +915,6 @@ void testStrndupa(size_t n) { clang_analyzer_isTainted_charp(result); // expected-warning {{YES}} } -size_t strlen(const char *s); -void testStrlen() { - char s[10]; - scanf("%9s", s); - - size_t result = strlen(s); - clang_analyzer_isTainted_int(res

[clang] 909c963 - [analyzer] Fix stdin declaration in C++ tests (#66074)

2023-09-14 Thread Balazs Benics via cfe-commits
Author: Balazs Benics Date: 2023-09-14T11:55:10+02:00 New Revision: 909c9639994b5467e8c8424580063e29139d1def URL: https://github.com/llvm/llvm-project/commit/909c9639994b5467e8c8424580063e29139d1def DIFF: https://github.com/llvm/llvm-project/commit/909c9639994b5467e8c8424580063e29139d1def.diff

[clang] 8243bc4 - [analyzer] Make socket `accept()` propagate taint (#66074)

2023-09-14 Thread Balazs Benics via cfe-commits
Author: Balazs Benics Date: 2023-09-14T11:55:10+02:00 New Revision: 8243bc40452bc90fa4f66a374d088907c1fe38cb URL: https://github.com/llvm/llvm-project/commit/8243bc40452bc90fa4f66a374d088907c1fe38cb DIFF: https://github.com/llvm/llvm-project/commit/8243bc40452bc90fa4f66a374d088907c1fe38cb.diff

[clang] 61924da - [analyzer] Propagate taint for wchar variants of some APIs (#66074)

2023-09-14 Thread Balazs Benics via cfe-commits
Author: Balazs Benics Date: 2023-09-14T11:55:10+02:00 New Revision: 61924da630532c91f00351b7e84548eb42e2e1e0 URL: https://github.com/llvm/llvm-project/commit/61924da630532c91f00351b7e84548eb42e2e1e0 DIFF: https://github.com/llvm/llvm-project/commit/61924da630532c91f00351b7e84548eb42e2e1e0.diff

[clang] [analyzer] First batch of patches for the Juliet benchmark for taint improvements (PR #66074)

2023-09-14 Thread Balazs Benics via cfe-commits
steakhal wrote: Merged manually, to allow landing these commits separately. https://github.com/llvm/llvm-project/pull/66074 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] First batch of patches for the Juliet benchmark for taint improvements (PR #66074)

2023-09-14 Thread Balazs Benics via cfe-commits
https://github.com/steakhal closed https://github.com/llvm/llvm-project/pull/66074 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] 2dee316 - Fixup "[analyzer] Propagate taint for wchar variants of some APIs"

2023-09-14 Thread Balazs Benics via cfe-commits
Author: Balazs Benics Date: 2023-09-14T12:22:11+02:00 New Revision: 2dee316a04be3fa466944542ee05926f28aa9ce4 URL: https://github.com/llvm/llvm-project/commit/2dee316a04be3fa466944542ee05926f28aa9ce4 DIFF: https://github.com/llvm/llvm-project/commit/2dee316a04be3fa466944542ee05926f28aa9ce4.diff

[clang] [analyzer] Fix taint sink rules for exec-like functions (PR #66358)

2023-09-14 Thread Balazs Benics via cfe-commits
https://github.com/steakhal labeled https://github.com/llvm/llvm-project/pull/66358 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Fix taint sink rules for exec-like functions (PR #66358)

2023-09-14 Thread Balazs Benics via cfe-commits
https://github.com/steakhal created https://github.com/llvm/llvm-project/pull/66358: Variadic arguments were not considered as taint sink arguments. I also decided to extend the list of exec-like functions. (Juliet CWE78_OS_Command_Injection__char_connect_socket_execl) --- This commit was sp

[clang] [analyzer] Fix taint sink rules for exec-like functions (PR #66358)

2023-09-14 Thread Balazs Benics via cfe-commits
https://github.com/steakhal review_requested https://github.com/llvm/llvm-project/pull/66358 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] TaintPropagation checker strlen() should not propagate (PR #66086)

2023-09-14 Thread Balazs Benics via cfe-commits
steakhal wrote: > So for me either solution would work: > a) remove strlen() as a propagator and note it in the checker doc > b) remove malloc() as a sink and note it in the checker doc > c) don't do anything and live with the false positives TBH I would prefer (b). I see removing the whole `Msg

[clang] [analyzer] TaintPropagation checker strlen() should not propagate (PR #66086)

2023-09-14 Thread Balazs Benics via cfe-commits
steakhal wrote: > Putting an upper bound on `strlen` is not just for `malloc`, it's also needed > for ArrayBoundV2. > > As a very clear example, this [function `strfuzz_ends_with` from > twin](https://codechecker-demo.eastus.cloudapp.azure.com/Default/report-detail?run=twin_v0.8.1_ednikru_tain

[clang] [analyzer] TaintPropagation checker strlen() should not propagate (PR #66086)

2023-09-14 Thread Balazs Benics via cfe-commits
steakhal wrote: Request another round of review once you are happy with the content and addressed the open comments. On the grand scheme we are aligned. https://github.com/llvm/llvm-project/pull/66086 ___ cfe-commits mailing list cfe-commits@lists.llv

[clang] [analyzer] Simplify SVal for simple NonLoc->Loc casts (PR #66463)

2023-09-15 Thread Balazs Benics via cfe-commits
https://github.com/steakhal edited https://github.com/llvm/llvm-project/pull/66463 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Simplify SVal for simple NonLoc->Loc casts (PR #66463)

2023-09-15 Thread Balazs Benics via cfe-commits
@@ -0,0 +1,31 @@ +// RUN: %clang_analyze_cc1 %s \ +// RUN: -analyzer-checker=core \ +// RUN: -analyzer-checker=debug.ExprInspection \ +// RUN: -analyzer-config eagerly-assume=false \ +// RUN: -verify + +void clang_analyzer_eval(int); + +void test_simplified_before_cast_add

[clang] [analyzer] Simplify SVal for simple NonLoc->Loc casts (PR #66463)

2023-09-15 Thread Balazs Benics via cfe-commits
@@ -0,0 +1,31 @@ +// RUN: %clang_analyze_cc1 %s \ +// RUN: -analyzer-checker=core \ +// RUN: -analyzer-checker=debug.ExprInspection \ +// RUN: -analyzer-config eagerly-assume=false \ +// RUN: -verify + +void clang_analyzer_eval(int); + +void test_simplified_before_cast_add

[clang] [analyzer] Simplify SVal for simple NonLoc->Loc casts (PR #66463)

2023-09-15 Thread Balazs Benics via cfe-commits
https://github.com/steakhal commented: I like it. Thanks! This is pretty much good to go, but let's have a short discussion first. https://github.com/llvm/llvm-project/pull/66463 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llv

[clang] [analyzer] Simplify SVal for simple NonLoc->Loc casts (PR #66463)

2023-09-15 Thread Balazs Benics via cfe-commits
@@ -264,7 +264,8 @@ ProgramStateRef ExprEngine::handleLValueBitCast( } // Delegate to SValBuilder to process. SVal OrigV = state->getSVal(Ex, LCtx); - SVal V = svalBuilder.evalCast(OrigV, T, ExTy); + SVal SimplifiedOrigV = svalBuilder.simplifySVal(state, OrigV); + SVal

[clang] [analyzer] Fix StackAddrEscapeChecker crash on temporary object fields (PR #66493)

2023-09-15 Thread Balazs Benics via cfe-commits
https://github.com/steakhal created https://github.com/llvm/llvm-project/pull/66493 Basically, the issue was that we should have unwrap the base region before we special handle temp object regions. Fixes https://github.com/llvm/llvm-project/issues/66221 I also decided to add some extra range

[clang] [analyzer] Simplify SVal for simple NonLoc->Loc casts (PR #66463)

2023-09-15 Thread Balazs Benics via cfe-commits
https://github.com/steakhal resolved https://github.com/llvm/llvm-project/pull/66463 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Simplify SVal for simple NonLoc->Loc casts (PR #66463)

2023-09-15 Thread Balazs Benics via cfe-commits
https://github.com/steakhal resolved https://github.com/llvm/llvm-project/pull/66463 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Simplify SVal for simple NonLoc->Loc casts (PR #66463)

2023-09-15 Thread Balazs Benics via cfe-commits
https://github.com/steakhal resolved https://github.com/llvm/llvm-project/pull/66463 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Simplify SVal for simple NonLoc->Loc casts (PR #66463)

2023-09-15 Thread Balazs Benics via cfe-commits
https://github.com/steakhal approved this pull request. Thanks! https://github.com/llvm/llvm-project/pull/66463 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Simplify SVal for simple NonLoc->Loc casts (PR #66463)

2023-09-15 Thread Balazs Benics via cfe-commits
https://github.com/steakhal closed https://github.com/llvm/llvm-project/pull/66463 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] 03693d5 - Revert "[analyzer] Simplify SVal for simple NonLoc->Loc casts (#66463)"

2023-09-15 Thread Balazs Benics via cfe-commits
Author: Balazs Benics Date: 2023-09-15T13:18:34+02:00 New Revision: 03693d5b40f187921ead5a502fa3cf72ce30fea4 URL: https://github.com/llvm/llvm-project/commit/03693d5b40f187921ead5a502fa3cf72ce30fea4 DIFF: https://github.com/llvm/llvm-project/commit/03693d5b40f187921ead5a502fa3cf72ce30fea4.diff

[clang] [analyzer] Simplify SVal for simple NonLoc->Loc casts (PR #66463)

2023-09-15 Thread Balazs Benics via cfe-commits
steakhal wrote: I thought "Mergeing" would wait and confirm if the checks pass, and only merge it if they succeed. Apparently, it's not the case here xD The tests now break even on x86 linux. Could you please have a look? @danix800 https://github.com/llvm/llvm-project/pull/66463 _

[clang] [analyzer] Fix StackAddrEscapeChecker crash on temporary object fields (PR #66493)

2023-09-15 Thread Balazs Benics via cfe-commits
@@ -398,7 +400,7 @@ void StackAddrEscapeChecker::checkEndFunction(const ReturnStmt *RS, }(Referrer->getMemorySpace()); // This cast supposed to succeed. steakhal wrote: I was thinking about it once you raised this comment. To me, to have a proper dia

[clang] [analyzer] Reduce constraint on modulo with small concrete range (PR #65448)

2023-09-15 Thread Balazs Benics via cfe-commits
@@ -1824,6 +1835,94 @@ RangeSet SymbolicRangeInferrer::VisitBinaryOperator(Range LHS, return {RangeFactory, ValueFactory.getValue(Min), ValueFactory.getValue(Max)}; } +RangeSet SymbolicRangeInferrer::handleConcreteModulo(Range LHS, +

[clang] [analyzer] Reduce constraint on modulo with small concrete range (PR #65448)

2023-09-15 Thread Balazs Benics via cfe-commits
@@ -1824,6 +1835,94 @@ RangeSet SymbolicRangeInferrer::VisitBinaryOperator(Range LHS, return {RangeFactory, ValueFactory.getValue(Min), ValueFactory.getValue(Max)}; } +RangeSet SymbolicRangeInferrer::handleConcreteModulo(Range LHS, +

[clang] [analyzer] Reduce constraint on modulo with small concrete range (PR #65448)

2023-09-15 Thread Balazs Benics via cfe-commits
https://github.com/steakhal commented: Uh, this isn't my expertiese. I'm a bit scared to do this alone. I'm also short on time to verify this patch at scale. https://github.com/llvm/llvm-project/pull/65448 ___ cfe-commits mailing list cfe-commits@lists

[clang] [analyzer] Reduce constraint on modulo with small concrete range (PR #65448)

2023-09-15 Thread Balazs Benics via cfe-commits
https://github.com/steakhal edited https://github.com/llvm/llvm-project/pull/65448 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] 7c9abbd - Reapply [analyzer] Simplify SVal for simple NonLoc->Loc casts

2023-09-15 Thread Balazs Benics via cfe-commits
Author: dingfei Date: 2023-09-15T15:07:39+02:00 New Revision: 7c9abbd8a41e85a7e82a454c62138ea72f981597 URL: https://github.com/llvm/llvm-project/commit/7c9abbd8a41e85a7e82a454c62138ea72f981597 DIFF: https://github.com/llvm/llvm-project/commit/7c9abbd8a41e85a7e82a454c62138ea72f981597.diff LOG:

[clang] [analyzer] Simplify SVal for simple NonLoc->Loc casts (PR #66498)

2023-09-15 Thread Balazs Benics via cfe-commits
steakhal wrote: Pushed manually with an adjusted commit message: https://github.com/llvm/llvm-project/commit/7c9abbd8a41e85a7e82a454c62138ea72f981597 https://github.com/llvm/llvm-project/pull/66498 ___ cfe-commits mailing list cfe-commits@lists.llvm.or

[clang] [analyzer] Simplify SVal for simple NonLoc->Loc casts (PR #66498)

2023-09-15 Thread Balazs Benics via cfe-commits
https://github.com/steakhal closed https://github.com/llvm/llvm-project/pull/66498 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Fix StackAddrEscapeChecker crash on temporary object fields (PR #66493)

2023-09-15 Thread Balazs Benics via cfe-commits
@@ -398,7 +400,7 @@ void StackAddrEscapeChecker::checkEndFunction(const ReturnStmt *RS, }(Referrer->getMemorySpace()); // This cast supposed to succeed. steakhal wrote: > I think the best would be either a comment that explains _why_ we expect a > `

[clang] [analyzer] TaintPropagation checker strlen() should not propagate (PR #66086)

2023-09-17 Thread Balazs Benics via cfe-commits
steakhal wrote: As I'm not a maintainer, I could not push to your branch. Here is a patch that I think has the missing pieces to satisfy my review. [0001-fixup-analyzer-TaintPropagation-checker-strlen-shoul.patch.txt](https://github.com/llvm/llvm-project/files/12645128/0001-fixup-analyzer-TaintPr

[clang] [analyzer] Fix StackAddrEscapeChecker crash on temporary object fields (PR #66493)

2023-09-17 Thread Balazs Benics via cfe-commits
https://github.com/steakhal updated https://github.com/llvm/llvm-project/pull/66493 >From cfdbc40487481b341d42f0472e196ff4bd33 Mon Sep 17 00:00:00 2001 From: Balazs Benics Date: Fri, 15 Sep 2023 12:42:39 +0200 Subject: [PATCH 1/2] [analyzer] Fix StackAddrEscapeChecker crash on temporary ob

[clang] [analyzer] Fix StackAddrEscapeChecker crash on temporary object fields (PR #66493)

2023-09-17 Thread Balazs Benics via cfe-commits
steakhal wrote: Let me know if you are still okay with the latest change. @DonatNagyE @Xazax-hun https://github.com/llvm/llvm-project/pull/66493 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/c

[clang] [analyzer] Add std::variant checker (PR #66481)

2023-09-18 Thread Balazs Benics via cfe-commits
@@ -0,0 +1,312 @@ +//===- StdVariantChecker.cpp -*- C++ -*-==// +// +// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. +// See https://llvm.org/LICENSE.txt for license information. +// SPDX-License-Identifier: Ap

[clang] [analyzer] Add std::variant checker (PR #66481)

2023-09-18 Thread Balazs Benics via cfe-commits
https://github.com/steakhal edited https://github.com/llvm/llvm-project/pull/66481 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Add std::variant checker (PR #66481)

2023-09-18 Thread Balazs Benics via cfe-commits
@@ -0,0 +1,312 @@ +//===- StdVariantChecker.cpp -*- C++ -*-==// +// +// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. +// See https://llvm.org/LICENSE.txt for license information. +// SPDX-License-Identifier: Ap

[clang] [analyzer] Add std::variant checker (PR #66481)

2023-09-18 Thread Balazs Benics via cfe-commits
@@ -0,0 +1,312 @@ +//===- StdVariantChecker.cpp -*- C++ -*-==// +// +// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. +// See https://llvm.org/LICENSE.txt for license information. +// SPDX-License-Identifier: Ap

[clang] [analyzer] Add std::variant checker (PR #66481)

2023-09-18 Thread Balazs Benics via cfe-commits
@@ -0,0 +1,312 @@ +//===- StdVariantChecker.cpp -*- C++ -*-==// +// +// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. +// See https://llvm.org/LICENSE.txt for license information. +// SPDX-License-Identifier: Ap

[clang] [analyzer] Add std::variant checker (PR #66481)

2023-09-18 Thread Balazs Benics via cfe-commits
@@ -0,0 +1,128 @@ +//===- TaggedUnionModeling.h -*- C++ -*-==// +// +// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. +// See https://llvm.org/LICENSE.txt for license information. +// SPDX-License-Identifier: Ap

[clang] [analyzer] Add std::variant checker (PR #66481)

2023-09-18 Thread Balazs Benics via cfe-commits
@@ -0,0 +1,312 @@ +//===- StdVariantChecker.cpp -*- C++ -*-==// +// +// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. +// See https://llvm.org/LICENSE.txt for license information. +// SPDX-License-Identifier: Ap

<    3   4   5   6   7   8   9   10   11   12   >