[clang] [clang][analyzer] Make per-entry-point metric rows uniquely identifiable (PR #161663)

2025-10-03 Thread Donát Nagy via cfe-commits
NagyDonat wrote: :thinking: How did this happen? I see that the "Build and test linux" CI job passed before the merge -- what's the difference between that build and this one that failed? https://github.com/llvm/llvm-project/pull/161663 ___ cfe-commi

[clang] [analyzer] Teach -analyze-function about USRs, extend documentation (PR #161666)

2025-10-03 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat approved this pull request. https://github.com/llvm/llvm-project/pull/161666 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [clang][analyzer] Make per-entry-point metric rows uniquely identifiable (PR #161663)

2025-10-03 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/161663 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [clang][analyzer] Make per-entry-point metric rows uniquely identifiable (PR #161663)

2025-10-03 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/161663 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [clang][analyzer] Make per-entry-point metric rows uniquely identifiable (PR #161663)

2025-10-03 Thread Donát Nagy via cfe-commits
@@ -65,6 +65,15 @@ STAT_MAX(MaxCFGSize, "The maximum number of basic blocks in a function."); namespace { +StringRef getMainFileName(const CompilerInvocation &Invocation) { + if (!Invocation.getFrontendOpts().Inputs.empty()) { +const FrontendInputFile &Input = Invocatio

[clang] [clang][analyzer] Make per-entry-point metric rows uniquely identifiable (PR #161663)

2025-10-03 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat approved this pull request. LGTM, seems to be a reasonable change. https://github.com/llvm/llvm-project/pull/161663 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe

[clang] [analyzer][NFC] Simplify Analysis/csv2json.py (PR #161665)

2025-10-03 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/161665 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer][NFC] Simplify Analysis/csv2json.py (PR #161665)

2025-10-03 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat approved this pull request. LGTM, seems to be a nice simplification. Note that `skipinitialspace` is not completely identical to the `.strip()` call because it only strips the whitespace _before_ the actual value, while `.strip()` would also strip whitespace after

[clang] [analyzer] Avoid use of `CallEvent`s with obsolete state (PR #160707)

2025-10-02 Thread Donát Nagy via cfe-commits
NagyDonat wrote: > Yeah my point is that these specific results aren't allowed to become > obsolete. > > The argument value is looked up from the Environment. A value of an > expression in Environment shall not change for as long as the expression > remains live. [...] Even if the callee code

[clang] [analyzer] CStringChecker: do not branch assuming the arguments of `str(n)cmp` are equal (PR #161644)

2025-10-02 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/161644 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] CStringChecker: do not branch assuming the arguments of `str(n)cmp` are equal (PR #161644)

2025-10-02 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat commented: I see that the old behavior had problems, but the new code also has a problematic aspect: in the case when the pointers may or may not be same (that is, when `StSameBuf && StNotSameBuf` is true) it always assumes that the pointers are not equal (because

[clang] [analyzer] Harden RegionStoreManager::bindArray (PR #153177)

2025-10-02 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat approved this pull request. LGTM, thanks for the updates! It's a bit unfortunate that `test3Bis` doesn't show the ideal behavior, but this commit is a clear step forward and there is no expectation to fix everything with one commit. https://github.com/llvm/llvm-pr

[clang] [analyzer] Harden RegionStoreManager::bindArray (PR #153177)

2025-10-02 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/153177 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Harden RegionStoreManager::bindArray (PR #153177)

2025-10-02 Thread Donát Nagy via cfe-commits
@@ -610,3 +610,44 @@ void top() { consume(parseMatchComponent()); } } // namespace elementwise_copy_small_array_from_post_initializer_of_cctor + +namespace gh147686 { +// The problem reported in https://github.com/llvm/llvm-project/issues/147686 +// is sensitive to the initia

[clang] [analyzer][NFC] Explain why operator new/delete should never be eval-called (PR #161370)

2025-09-30 Thread Donát Nagy via cfe-commits
@@ -1110,6 +1117,10 @@ void ExprEngine::VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, if (AMgr.getAnalyzerOptions().MayInlineCXXAllocator) { StmtNodeBuilder Bldr(DstPreCall, DstPostCall, *currBldrCtx); for (ExplodedNode *I : DstPreCall) { + // Intentionally eithe

[clang] [analyzer] Avoid use of `CallEvent`s with obsolete state (PR #160707)

2025-09-30 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat updated https://github.com/llvm/llvm-project/pull/160707 From 0685f09cb8316dd492aceea60413a3ffd9b2987f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Don=C3=A1t=20Nagy?= Date: Thu, 25 Sep 2025 15:21:12 +0200 Subject: [PATCH] [analyzer] Avoid use of `CallEvent`s with obsol

[clang] [analyzer] Avoid use of `CallEvent`s with obsolete state (PR #160707)

2025-09-30 Thread Donát Nagy via cfe-commits
@@ -731,33 +731,36 @@ void CheckerManager::runCheckersForEvalCall(ExplodedNodeSet &Dst, ExplodedNodeSet checkDst; NodeBuilder B(Pred, checkDst, Eng.getBuilderContext()); +ProgramStateRef State = Pred->getState(); +CallEventRef<> UpdatedCall = Call.cloneWithSta

[clang] [analyzer] Avoid use of `CallEvent`s with obsolete state (PR #160707)

2025-09-30 Thread Donát Nagy via cfe-commits
@@ -731,33 +731,36 @@ void CheckerManager::runCheckersForEvalCall(ExplodedNodeSet &Dst, ExplodedNodeSet checkDst; NodeBuilder B(Pred, checkDst, Eng.getBuilderContext()); +ProgramStateRef State = Pred->getState(); +CallEventRef<> UpdatedCall = Call.cloneWithSta

[clang] [analyzer] CStringChecker: fix crash in `CheckOverlap` when arguments are not pointers (PR #160511)

2025-09-26 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat approved this pull request. LGTM, thanks for the updates! One more minor remark is that perhaps `buffer-overlap-nonstandard-decls.c` would be a more descriptive name than `buffer-overlap-alt.c`. https://github.com/llvm/llvm-project/pull/160511 _

[clang] [analyzer] Avoid use of `CallEvent`s with obsolete state (PR #160707)

2025-09-25 Thread Donát Nagy via cfe-commits
NagyDonat wrote: As I'm digging around the codebase, I see that it's a common (anti)pattern that some function takes both a `CallEvent` and a `ProgramStateRef` (or an exploded node which has its own state) in a way that the `State` in the `CallEvent` is probably obsolete and the code tries to

[clang] [analyzer] Avoid use of `CallEvent`s with obsolete state (PR #160707)

2025-09-25 Thread Donát Nagy via cfe-commits
@@ -1212,59 +1222,58 @@ static bool isTrivialObjectAssignment(const CallEvent &Call) { } void ExprEngine::defaultEvalCall(NodeBuilder &Bldr, ExplodedNode *Pred, - const CallEvent &CallTemplate, + const CallEvent

[clang] [analyzer] Avoid use of `CallEvent`s with obsolete state (PR #160707)

2025-09-25 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat created https://github.com/llvm/llvm-project/pull/160707 The method `ExprEngine::evalCall` handles multiple state transitions and activates various checker callbacks that take a `CallEvent` parameter (among other parameters). Unfortunately some of these callbacks (

[clang] [analyzer] CStringChecker: fix crash in `CheckOverlap` when arguments are not pointers (PR #160511)

2025-09-24 Thread Donát Nagy via cfe-commits
@@ -96,3 +96,19 @@ void test_snprintf6() { char b[4] = {0}; snprintf(a, sizeof(a), "%s", b); // no-warning } + + +void memcpy(int dst, int src, size_t size); // expected-warning{{incompatible redeclaration of library function 'memcpy'}} expected-note{{'memcpy' is a builti

[clang] [analyzer] CStringChecker: fix crash in `CheckOverlap` when arguments are not pointers (PR #160511)

2025-09-24 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/160511 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] CStringChecker: fix crash in `CheckOverlap` when arguments are not pointers (PR #160511)

2025-09-24 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/160511 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] CStringChecker: fix crash in `CheckOverlap` when arguments are not pointers (PR #160511)

2025-09-24 Thread Donát Nagy via cfe-commits
@@ -96,3 +96,19 @@ void test_snprintf6() { char b[4] = {0}; snprintf(a, sizeof(a), "%s", b); // no-warning } + + +void memcpy(int dst, int src, size_t size); // expected-warning{{incompatible redeclaration of library function 'memcpy'}} expected-note{{'memcpy' is a builti

[clang] [analyzer] CStringChecker: fix crash in `CheckOverlap` when arguments are not pointers (PR #160511)

2025-09-24 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/160511 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] CStringChecker: fix crash in `CheckOverlap` when arguments are not pointers (PR #160511)

2025-09-24 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat approved this pull request. Thanks for the commit, crash fixes are always welcome! I added two very minor stylistic suggestion in inline comments, but the commit is also acceptable in its current form. Moreover, in the commit message you write that "`CheckOverlap`

[clang] [clang][analyzer] Support strlen with offset to string literal in CStringChecker (PR #159795)

2025-09-22 Thread Donát Nagy via cfe-commits
@@ -235,6 +242,19 @@ void testStrlenCallee(void) { clang_analyzer_eval(lenBefore == lenAfter); // expected-warning{{UNKNOWN}} } +void strlen_symbolic_offset(unsigned x) { + const char *str = "abcd"; + if (x > 3) +return; + // FIXME: these should be known -

[clang] [clang][analyzer] Support strlen with offset to string literal in CStringChecker (PR #159795)

2025-09-22 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat commented: Great commit, LGTM overall! I found only one very minor issue in the tests. https://github.com/llvm/llvm-project/pull/159795 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin

[clang] [clang][analyzer] Support strlen with offset to string literal in CStringChecker (PR #159795)

2025-09-22 Thread Donát Nagy via cfe-commits
@@ -235,6 +242,19 @@ void testStrlenCallee(void) { clang_analyzer_eval(lenBefore == lenAfter); // expected-warning{{UNKNOWN}} } +void strlen_symbolic_offset(unsigned x) { + const char *str = "abcd"; + if (x > 3) +return; + // FIXME: these should be known -

[clang] [analyzer] Enhance array bound checking for `ConstantArrayType` (PR #159357)

2025-09-22 Thread Donát Nagy via cfe-commits
NagyDonat wrote: @alejandro-alvarez-sonarsource Thanks for the detailed answers and clarifications! :smile: > I tend to be conservative about existing behavior because > > 1. It is working! > > 2. We have been relying on it for long, and even a small divergence could > turn into hund

[clang] [analyzer] Hotfix a boolean conversion crash in the Z3 SMTConv (PR #158276)

2025-09-22 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat approved this pull request. LGTM. > I'd only highlight here that I think using the argument that anything is > better than having a crash - while is true, still leaves a bitter taste. I have not counted how many similar crashes we had within the Z3 conversion layer

[clang] [analyzer] Correct crash in Z3 wrapper (PR #158276)

2025-09-21 Thread Donát Nagy via cfe-commits
@@ -455,6 +455,14 @@ class SMTConv { QualType OperandTy; llvm::SMTExprRef OperandExp = getSymExpr(Solver, Ctx, USE->getOperand(), &OperandTy, hasComparison); + + if (const BinarySymExpr *BSE = + dyn_cast(USE->getOperand())) { +if

[clang] [analyzer] Correct crash in Z3 wrapper (PR #158276)

2025-09-21 Thread Donát Nagy via cfe-commits
@@ -455,6 +455,14 @@ class SMTConv { QualType OperandTy; llvm::SMTExprRef OperandExp = getSymExpr(Solver, Ctx, USE->getOperand(), &OperandTy, hasComparison); + + if (const BinarySymExpr *BSE = + dyn_cast(USE->getOperand())) { +if

[clang] [analyzer] Correct crash in Z3 wrapper (PR #158276)

2025-09-21 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat commented: I agree that it's unfortunate that we don't have a more general solution for this problem. However, not crashing is still better than crashing, so if nobody has capacity to develop a more general solution, then I think we should still merge this PR (with

[clang] [analyzer] Correct crash in Z3 wrapper (PR #158276)

2025-09-21 Thread Donát Nagy via cfe-commits
@@ -1,15 +1,49 @@ // RUN: %clang_analyze_cc1 -analyzer-checker=core,debug.ExprInspection -verify %s \ // RUN: -analyzer-constraints=z3 +// RUN: %clang_analyze_cc1 -verify %s \ +// RUN: -analyzer-checker=core,debug.ExprInspection \ +// RUN: -analyzer-config crosscheck-with-z

[clang] [analyzer] Correct crash in Z3 wrapper (PR #158276)

2025-09-21 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/158276 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Show element count in ArrayBound underflow reports (PR #158639)

2025-09-20 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat updated https://github.com/llvm/llvm-project/pull/158639 From db0723ca737ec4613d186ff1137c7405c480baf3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Don=C3=A1t=20Nagy?= Date: Mon, 15 Sep 2025 15:48:12 +0200 Subject: [PATCH 1/5] [analyzer] Show element count in ArrayBound

[clang] [clang][analyzer] Add checker 'core.NullPointerArithm' (PR #157129)

2025-09-20 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat commented: Overall looks good to me, thanks for the patch! I added a few remarks in inline comments. https://github.com/llvm/llvm-project/pull/157129 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.ll

[clang] [clang][analyzer] Add checker 'core.NullPointerArithm' (PR #157129)

2025-09-20 Thread Donát Nagy via cfe-commits
@@ -72,6 +74,9 @@ class DereferenceChecker const DerefBugType FixedAddressBug{&FixedDerefChecker, "Dereference of a fixed address", "a dereference of a fixed address"}; + const BugType NullPointerArith

[clang] [clang][analyzer] Add checker 'core.NullPointerArithm' (PR #157129)

2025-09-20 Thread Donát Nagy via cfe-commits
@@ -379,6 +386,111 @@ void DereferenceChecker::checkBind(SVal L, SVal V, const Stmt *S, C.addTransition(State, this); } +void DereferenceChecker::checkPreStmt(const BinaryOperator *Op, + CheckerContext &C) const { + if (!Op->isAdditiveO

[clang] [NFC][analyzer] Fix copypaste error in security.VAList docs (PR #157440)

2025-09-20 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat created https://github.com/llvm/llvm-project/pull/157440 My recent commit a80c393a9c498279a1ec9fd630535b9ff139b49f accidentally added a paragraph which does not belong to the new documentation of the checker `security.VAList`; this commit corrects this mistake. Fr

[clang] [analyzer] Improve messaging in security.VAList (PR #157846)

2025-09-18 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/157846 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [clang][analyzer] Add checker 'core.NullPointerArithm' (PR #157129)

2025-09-18 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/157129 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [clang][analyzer] Add checker 'core.NullPointerArithm' (PR #157129)

2025-09-18 Thread Donát Nagy via cfe-commits
@@ -205,6 +205,47 @@ pointers with a specified address space. If the option is set to false, then reports from the specific x86 address spaces 256, 257 and 258 are still suppressed, but null dereferences from other address spaces are reported. +.. _core-NullPointerArithm: + +

[clang] [clang][analyzer] Add checker 'core.NullPointerArithm' (PR #157129)

2025-09-18 Thread Donát Nagy via cfe-commits
@@ -213,30 +213,33 @@ Check for undefined arithmetic operations with null pointers. The checker can detect the following cases: - - `p + x` and `x + p` where `p` is a null pointer and `x` is a nonzero integer + - ``p + x`` and ``x + p`` where ``p`` is a null pointer and `

[clang] [analyzer] Enhance array bound checking for `ConstantArrayType` (PR #159357)

2025-09-18 Thread Donát Nagy via cfe-commits
@@ -555,24 +588,305 @@ std::string StateUpdateReporter::getMessage(PathSensitiveBugReport &BR) const { return std::string(Out.str()); } -bool StateUpdateReporter::providesInformationAboutInteresting( -SymbolRef Sym, PathSensitiveBugReport &BR) { - if (!Sym) -return

[clang-tools-extra] [clang-tidy] Add check 'bugprone-cast-to-struct' (PR #153428)

2025-09-18 Thread Donát Nagy via cfe-commits
@@ -0,0 +1,60 @@ +.. title:: clang-tidy - bugprone-cast-to-struct + +bugprone-cast-to-struct +=== + +Finds casts from pointers to struct or scalar type to pointers to struct type. + +Casts between pointers to different structs can be unsafe because it is possi

[clang] [analyzer] Enhance array bound checking for `ConstantArrayType` (PR #159357)

2025-09-18 Thread Donát Nagy via cfe-commits
NagyDonat wrote: @alejandro-alvarez-sonarsource @steakhal What do you think about the code duplication situation? What are your reasons for proposing this implementation? If I understand correctly the "new" type-based bounds checking differs from the "old" region/extent-based logic in the foll

[clang] [analyzer] Enhance array bound checking for `ConstantArrayType` (PR #159357)

2025-09-18 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat commented: I'm very happy to see that you are implementing these enhancements; they were also on my long-term todo list but I didn't know when would I have time for implementing them. Unfortunately it seems that your commit duplicates several hundred lines of code

[clang] [clang][analyzer] Add checker 'core.NullPointerArithm' (PR #157129)

2025-09-18 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat approved this pull request. LGTM if you fix the one very minor issue that I marked in inline comment and @steakhal is also satisfied with the changes. https://github.com/llvm/llvm-project/pull/157129 ___ cfe-commits mailin

[clang] [analyzer] Enhance array bound checking for `ConstantArrayType` (PR #159357)

2025-09-18 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/159357 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Enhance array bound checking for `ConstantArrayType` (PR #159357)

2025-09-18 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/159357 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Enhance array bound checking for `ConstantArrayType` (PR #159357)

2025-09-18 Thread Donát Nagy via cfe-commits
@@ -555,24 +588,305 @@ std::string StateUpdateReporter::getMessage(PathSensitiveBugReport &BR) const { return std::string(Out.str()); } -bool StateUpdateReporter::providesInformationAboutInteresting( -SymbolRef Sym, PathSensitiveBugReport &BR) { - if (!Sym) -return

[clang] [clang] Implement -Walloc-size diagnostic option (PR #150028)

2025-09-17 Thread Donát Nagy via cfe-commits
NagyDonat wrote: > > [...] **while negative-sized allocations are not currently covered but > > would be easy to handle.)** > > I didn't read the discussion but I'm not sure how to interpret this > highlighted sentence. It's just a dumb mistake, I just forgot that the parameter of `malloc` is

[clang] [analyzer] Show element count in ArrayBound underflow reports (PR #158639)

2025-09-17 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat updated https://github.com/llvm/llvm-project/pull/158639 From db0723ca737ec4613d186ff1137c7405c480baf3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Don=C3=A1t=20Nagy?= Date: Mon, 15 Sep 2025 15:48:12 +0200 Subject: [PATCH 1/2] [analyzer] Show element count in ArrayBound

[clang] [analyzer][NFC] Rename LivenessValues::equals to LivenessValues::operator== (PR #157657)

2025-09-17 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat approved this pull request. https://github.com/llvm/llvm-project/pull/157657 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Show element count in ArrayBound underflow reports (PR #158639)

2025-09-17 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/158639 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Show element count in ArrayBound underflow reports (PR #158639)

2025-09-17 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat closed https://github.com/llvm/llvm-project/pull/158639 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Show element count in ArrayBound underflow reports (PR #158639)

2025-09-17 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/158639 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Show element count in ArrayBound underflow reports (PR #158639)

2025-09-16 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/158639 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Show element count in ArrayBound underflow reports (PR #158639)

2025-09-16 Thread Donát Nagy via cfe-commits
@@ -430,30 +419,41 @@ static bool tryDividePair(std::optional &Val1, return true; } -static Messages getExceedsMsgs(const MemSpaceRegion *Space, +static Messages getNonTaintMsgs(ASTContext &ACtx, const MemSpaceRegion *Space, NagyDonat wrote: Good point, don

[clang] [analyzer] Show element count in ArrayBound underflow reports (PR #158639)

2025-09-16 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/158639 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Show element count in ArrayBound underflow reports (PR #158639)

2025-09-16 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat updated https://github.com/llvm/llvm-project/pull/158639 From db0723ca737ec4613d186ff1137c7405c480baf3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Don=C3=A1t=20Nagy?= Date: Mon, 15 Sep 2025 15:48:12 +0200 Subject: [PATCH 1/4] [analyzer] Show element count in ArrayBound

[clang] [analyzer] Show element count in ArrayBound underflow reports (PR #158639)

2025-09-16 Thread Donát Nagy via cfe-commits
@@ -40,7 +70,7 @@ void gh86959(void) { while (rng()) TenElements[getIndex()] = 10; // expected-warning@-1 {{Out of bound access to memory preceding 'TenElements'}} - // expected-note@-2 {{Access of 'TenElements' at negative byte offset -688}} + // expected-note@-2 {{

[clang] [analyzer] Show element count in ArrayBound underflow reports (PR #158639)

2025-09-16 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat updated https://github.com/llvm/llvm-project/pull/158639 From db0723ca737ec4613d186ff1137c7405c480baf3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Don=C3=A1t=20Nagy?= Date: Mon, 15 Sep 2025 15:48:12 +0200 Subject: [PATCH 1/3] [analyzer] Show element count in ArrayBound

[clang] [analyzer] Improve messaging in security.VAList (PR #157846)

2025-09-16 Thread Donát Nagy via cfe-commits
NagyDonat wrote: I abandoned my plans to implement coverage for the SEI-CERT rule MSC39-C because it turns out that `security.VAList` doesn't model `va_list`s properly if they are passed to functions by value (it associates the metadata with regions) and fixing this system would be too difficu

[clang] [analyzer] Show element count in ArrayBound underflow reports (PR #158639)

2025-09-16 Thread Donát Nagy via cfe-commits
@@ -40,7 +70,7 @@ void gh86959(void) { while (rng()) TenElements[getIndex()] = 10; // expected-warning@-1 {{Out of bound access to memory preceding 'TenElements'}} - // expected-note@-2 {{Access of 'TenElements' at negative byte offset -688}} + // expected-note@-2 {{

[clang] [analyzer] Show element count in ArrayBound underflow reports (PR #158639)

2025-09-15 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat created https://github.com/llvm/llvm-project/pull/158639 The underflow reports of checker security.ArrayBound already displayed the (negative) byte offset of the accessed location; but those numbers were sometimes a bit hard to decipher, so I'm extending the messag

[clang] [analyzer] Improve messaging in security.VAList (PR #157846)

2025-09-13 Thread Donát Nagy via cfe-commits
NagyDonat wrote: I agree that the test coverage is bad (by the way IIRC the tests where composed by me 10 years ago within my first contribution to clang). I'll try to set up tests that systemically check each branch. https://github.com/llvm/llvm-project/pull/157846 ___

[clang-tools-extra] [clang-tidy] Add check 'bugprone-cast-to-struct' (PR #153428)

2025-09-13 Thread Donát Nagy via cfe-commits
@@ -0,0 +1,60 @@ +.. title:: clang-tidy - bugprone-cast-to-struct + +bugprone-cast-to-struct +=== + +Finds casts from pointers to struct or scalar type to pointers to struct type. + +Casts between pointers to different structs can be unsafe because it is possi

[clang] [analyzer] Prevent triplicate warnings for `sarif-html` (PR #158112)

2025-09-12 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat commented: I'm not familiar with this part of the codebase, but the change looks reasonable and fixes an obvious bug. https://github.com/llvm/llvm-project/pull/158112 ___ cfe-commits mailing list cfe-commits@lists.llvm.org

[clang] [analyzer] Correct crash in Z3 wrapper (PR #158276)

2025-09-12 Thread Donát Nagy via cfe-commits
@@ -13,3 +13,29 @@ int negate(int x, int y) { return 0; return 1; } + +void c(); +void case004(int *a, int *b) { + void *e; + b != a; + c(e); // expected-warning{{1st function call argument is an uninitialized value}} +} NagyDonat wrote: How is this

[clang] [analyzer] Correct crash in Z3 wrapper (PR #158276)

2025-09-12 Thread Donát Nagy via cfe-commits
@@ -13,3 +13,29 @@ int negate(int x, int y) { return 0; return 1; } + +void c(); +void case004(int *a, int *b) { + void *e; + b != a; + c(e); // expected-warning{{1st function call argument is an uninitialized value}} +} + +void z3crash(int a, int b) { + b = a || b;

[clang] [analyzer] Correct crash in Z3 wrapper (PR #158276)

2025-09-12 Thread Donát Nagy via cfe-commits
@@ -13,3 +13,29 @@ int negate(int x, int y) { return 0; return 1; } + +void c(); +void case004(int *a, int *b) { + void *e; + b != a; + c(e); // expected-warning{{1st function call argument is an uninitialized value}} +} + +void z3crash(int a, int b) { + b = a || b;

[clang] [analyzer] Correct crash in Z3 wrapper (PR #158276)

2025-09-12 Thread Donát Nagy via cfe-commits
@@ -455,6 +455,13 @@ class SMTConv { QualType OperandTy; llvm::SMTExprRef OperandExp = getSymExpr(Solver, Ctx, USE->getOperand(), &OperandTy, hasComparison); + + if (const BinarySymExpr *BSE = + dyn_cast(USE->getOperand())) { +if

[clang] [analyzer] Correct crash in Z3 wrapper (PR #158276)

2025-09-12 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat commented: I added some inline comments; but I know almost nothing about the Z3 solver and related code, so I would be grateful if somebody with more knowledge would also review this change. https://github.com/llvm/llvm-project/pull/158276 _

[clang] [analyzer] Correct crash in Z3 wrapper (PR #158276)

2025-09-12 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/158276 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [clang] Implement -Walloc-size diagnostic option (PR #150028)

2025-09-12 Thread Donát Nagy via cfe-commits
NagyDonat wrote: This is a clear example for a bug type where the simple AST matching that can be done in a diagnostic warning is insufficient and the path-sensitive analysis of the clang static analyzer provides much better reports. The AST pattern matching does not follow the control flow an

[clang] [analyzer] Improve messaging in security.VAList (PR #157846)

2025-09-12 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat closed https://github.com/llvm/llvm-project/pull/157846 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Improve messaging in security.VAList (PR #157846)

2025-09-12 Thread Donát Nagy via cfe-commits
NagyDonat wrote: @steakhal I looked through the code of this checker and added a few tests to ensure that all message kinds are covered by the testing (which implies high coverage for the whole checker: most of the logic is "behind" one kind of message). I was a bit surprised to see that I did

[clang] [analyzer] Improve messaging in security.VAList (PR #157846)

2025-09-12 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat updated https://github.com/llvm/llvm-project/pull/157846 From 73f621f1db437ba07e2de2deae9829ce524eb30f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Don=C3=A1t=20Nagy?= Date: Wed, 10 Sep 2025 14:20:05 +0200 Subject: [PATCH 1/3] [analyzer] Improve messaging in security.VA

[clang] [analyzer] Improve messaging in security.VAList (PR #157846)

2025-09-12 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/157846 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Improve messaging in security.VAList (PR #157846)

2025-09-12 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat updated https://github.com/llvm/llvm-project/pull/157846 From 73f621f1db437ba07e2de2deae9829ce524eb30f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Don=C3=A1t=20Nagy?= Date: Wed, 10 Sep 2025 14:20:05 +0200 Subject: [PATCH 1/2] [analyzer] Improve messaging in security.VA

[clang] [analyzer] Improve messaging in security.VAList (PR #157846)

2025-09-12 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat created https://github.com/llvm/llvm-project/pull/157846 Previously the checker `security.VAList` only tracked the set of the inintialized `va_list` objects; this commit replaces this with a mapping that can distinguish the "uninitialized" `va_list` objects from th

[clang-tools-extra] [clang-tidy] Add check 'bugprone-cast-to-struct' (PR #153428)

2025-09-09 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/153428 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer][NFC] Fix a warning in RegionStore.cpp (PR #157630)

2025-09-09 Thread Donát Nagy via cfe-commits
NagyDonat wrote: @steakhal Why did you discard this patch? It looks good to me at first glance. https://github.com/llvm/llvm-project/pull/157630 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe

[clang-tools-extra] [clang-tidy] Add check 'bugprone-cast-to-struct' (PR #153428)

2025-09-09 Thread Donát Nagy via cfe-commits
@@ -0,0 +1,82 @@ +//===--- CastToStructCheck.cpp - clang-tidy ---===// +// +// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. +// See https://llvm.org/LICENSE.txt for license information. +// SPDX-License-Identifier: Apa

[clang-tools-extra] [clang-tidy] Add check 'bugprone-cast-to-struct' (PR #153428)

2025-09-09 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/153428 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [analyzer] Revert #115918, so empty base class optimization works again (PR #157480)

2025-09-08 Thread Donát Nagy via cfe-commits
NagyDonat wrote: Sounds reasonable. I feel a bit guilty that I wasn't able to predict this regression when I reviewed the reverted commit as "LGTM, clean little patch", but I don't think that I could've done better without investing drastically more effort into the review. By the way does th

[clang] [NFC][analyzer] Fix copypaste error in security.VAList docs (PR #157440)

2025-09-08 Thread Donát Nagy via cfe-commits
NagyDonat wrote: As this patch is very trivial, I'll merge it without reviews when the CI succeeds. https://github.com/llvm/llvm-project/pull/157440 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinf

[clang] [llvm] [NFC][analyzer] Rename `ValistChecker.cpp` to `VAListChecker.cpp` (PR #157438)

2025-09-08 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat closed https://github.com/llvm/llvm-project/pull/157438 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [clang][analyzer] Add checker 'core.NullPointerArithm' (PR #157129)

2025-09-08 Thread Donát Nagy via cfe-commits
@@ -173,9 +178,11 @@ static bool isDeclRefExprToReference(const Expr *E) { return false; } -void DereferenceChecker::reportBug(const DerefBugType &BT, - ProgramStateRef State, const Stmt *S, - CheckerContext

[clang] [clang][analyzer] Add checker 'core.NullPointerArithm' (PR #157129)

2025-09-08 Thread Donát Nagy via cfe-commits
@@ -379,6 +386,111 @@ void DereferenceChecker::checkBind(SVal L, SVal V, const Stmt *S, C.addTransition(State, this); } +void DereferenceChecker::checkPreStmt(const BinaryOperator *Op, + CheckerContext &C) const { + if (!Op->isAdditiveO

[clang] [NFC][analyzer] Fix copypaste error in security.VAList docs (PR #157440)

2025-09-08 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat closed https://github.com/llvm/llvm-project/pull/157440 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [clang][analyzer] Add checker 'core.NullPointerArithm' (PR #157129)

2025-09-08 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat edited https://github.com/llvm/llvm-project/pull/157129 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [llvm] [NFC][analyzer] Rename `ValistChecker.cpp` to `VAListChecker.cpp` (PR #157438)

2025-09-08 Thread Donát Nagy via cfe-commits
NagyDonat wrote: As this patch is very trivial and I already promised it within https://github.com/llvm/llvm-project/pull/156682 (which was reviewed), I'll merge it without a separate review when the CI succeeds. https://github.com/llvm/llvm-project/pull/157438 ___

[clang] [llvm] [NFC][analyzer] Rename `ValistChecker.cpp` to `VAListChecker.cpp` (PR #157438)

2025-09-08 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat created https://github.com/llvm/llvm-project/pull/157438 ...to follow the capitalization style that was already applied within the file by recent commit a80c393a9c498279a1ec9fd630535b9ff139b49f. From e9978e652252e161eb48a09d798fd1b1eee486bc Mon Sep 17 00:00:00 2001

[clang] [analyzer] Consolidate the va_list checkers (PR #156682)

2025-09-08 Thread Donát Nagy via cfe-commits
https://github.com/NagyDonat closed https://github.com/llvm/llvm-project/pull/156682 ___ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

  1   2   3   4   5   6   7   8   9   10   >