aboutsummaryrefslogtreecommitdiff
path: root/gcc/analyzer
AgeCommit message (Collapse)AuthorFilesLines
2022-11-07analyzer: start adding support for errnoDavid Malcolm9-2/+144
gcc/analyzer/ChangeLog: * region-model-impl-calls.cc (region_model::impl_call_errno_location): New. * region-model-manager.cc (region_model_manager::region_model_manager): Initialize m_thread_local_region and m_errno_region. * region-model-manager.h (region_model_manager::get_errno_region): New accessor. (region_model_manager::m_thread_local_region): New. (region_model_manager::m_errno_region): New. * region-model.cc (region_model::on_call_pre): Special-case "__errno_location". (region_model::set_errno): New. * region-model.h (impl_call_errno_location): New decl. (region_model::set_errno): New decl. * region.cc (thread_local_region::dump_to_pp): New. (errno_region::dump_to_pp): New. * region.h (enum memory_space): Add MEMSPACE_THREAD_LOCAL. (enum region_kind): Add RK_THREAD_LOCAL and RK_ERRNO. (class thread_local_region): New. (is_a_helper <const thread_local_region *>::test): New. (class errno_region): New. (is_a_helper <const errno_region *>::test): New. * store.cc (binding_cluster::escaped_p): New. (store::escaped_p): Treat errno as always having escaped. (store::replay_call_summary_cluster): Handle RK_THREAD_LOCAL and RK_ERRNO. * store.h (binding_cluster::escaped_p): Remove definition. gcc/testsuite/ChangeLog: * gcc.dg/analyzer/errno-1.c: New test. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-11-07analyzer: introduce succeed_or_fail_call_infoDavid Malcolm2-23/+32
This makes some followup code much cleaner. gcc/analyzer/ChangeLog: * call-info.cc (success_call_info::get_desc): Delete. (failed_call_info::get_desc): Likewise. (succeed_or_fail_call_info::get_desc): New. * call-info.h (class succeed_or_fail_call_info): New. (class success_call_info): Convert to a subclass of succeed_or_fail_call_info. (class failed_call_info): Likewise. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-11-07analyzer: fix "when 'strchr' returns non-NULL" messageDavid Malcolm2-9/+19
Tweak analyzer handling of strchr, so that we show the when 'strchr' returns non-NULL message for that execution path. gcc/analyzer/ChangeLog: * region-model-impl-calls.cc (region_model::impl_call_strchr): Move to on_call_post. Handle both outcomes using bifurcation, rather than just the "not found" case. * region-model.cc (region_model::on_call_pre): Move BUILT_IN_STRCHR and "strchr" to... (region_model::on_call_post): ...here. gcc/testsuite/ChangeLog: * gcc.dg/analyzer/strchr-1.c (test_literal): Detect writing to a string literal. Verify that we emit the "when '__builtin_strchr' returns non-NULL" message. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-11-04Daily bump.GCC Administrator1-0/+241
2022-11-03analyzer: use std::unique_ptr for state machines from pluginsDavid Malcolm2-3/+3
gcc/analyzer/ChangeLog: * analyzer.h: Use std::unique_ptr for state machines from plugins. * engine.cc: Likewise. gcc/testsuite/ChangeLog: * gcc.dg/plugin/analyzer_gil_plugin.c: Use std::unique_ptr for state machines from plugins. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-11-03analyzer: use std::unique_ptr for known functionsDavid Malcolm4-6/+7
gcc/analyzer/ChangeLog: * analyzer.h: Use std::unique_ptr for known functions. * engine.cc: Likewise. * known-function-manager.cc: Likewise. * known-function-manager.h: Likewise. gcc/testsuite/ChangeLog: * gcc.dg/plugin/analyzer_kernel_plugin.c: Use std::unique_ptr for known functions. * gcc.dg/plugin/analyzer_known_fns_plugin.c: Likewise. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-11-03analyzer: use std::unique_ptr during bifurcationDavid Malcolm14-28/+31
gcc/analyzer/ChangeLog: * analysis-plan.cc: Define INCLUDE_MEMORY before including system.h. * analyzer-pass.cc: Likewise. * analyzer-selftests.cc: Likewise. * analyzer.cc: Likewise. * analyzer.h: Use std::unique_ptr in bifurcation code. * call-string.cc: Define INCLUDE_MEMORY before including system.h. * complexity.cc: Likewise. * engine.cc: Use std::unique_ptr in bifurcation code. * exploded-graph.h: Likewise. * known-function-manager.cc: Define INCLUDE_MEMORY before including system.h. * region-model-impl-calls.cc: Use std::unique_ptr in bifurcation code. * region-model.cc: Likewise. * region-model.h: Likewise. * supergraph.cc: Define INCLUDE_MEMORY before including system.h. gcc/testsuite/ChangeLog: * gcc.dg/plugin/analyzer_kernel_plugin.c: Include "make-unique.h". Use std::unique_ptr in bifurcation code. * gcc.dg/plugin/analyzer_known_fns_plugin.c: Likewise. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-11-03analyzer: use std::unique_ptr for checker_eventDavid Malcolm8-120/+133
gcc/analyzer/ChangeLog: * call-info.cc: Use std::unique_ptr for checker_event. * checker-path.cc: Likewise. * checker-path.h: Likewise. * diagnostic-manager.cc: Likewise. * engine.cc: Likewise. * pending-diagnostic.cc: Likewise. * sm-signal.cc: Likewise. * varargs.cc: Likewise. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-11-03analyzer: use std::unique_ptr for feasibility_problems and exploded_pathDavid Malcolm6-47/+43
gcc/analyzer/ChangeLog: * diagnostic-manager.cc: Include "make-unique.h". Use std::unique_ptr for feasibility_problems and exploded_path. Delete explicit saved_diagnostic dtor. * diagnostic-manager.h: Likewise. * engine.cc: Likewise. * exploded-graph.h: Likewise. * feasible-graph.cc: Likewise. * feasible-graph.h: Likewise. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-11-03analyzer: use std::unique_ptr for custom_edge_info pointersDavid Malcolm4-42/+25
gcc/analyzer/ChangeLog: * checker-path.cc (rewind_event::rewind_event): Update for usage of std::unique_ptr on custom_edge_info. * engine.cc (exploded_node::on_longjmp): Likewise. (exploded_edge::exploded_edge): Likewise. (exploded_edge::~exploded_edge): Delete. (exploded_graph::add_function_entry): Update for usage of std::unique_ptr on custom_edge_info. (exploded_graph::add_edge): Likewise. (add_tainted_args_callback): Likewise. (exploded_graph::maybe_create_dynamic_call): Likewise. (exploded_graph::process_node): Likewise. * exploded-graph.h (exploded_edge::~exploded_edge): Delete. (exploded_edge::m_custom_info): Use std::unique_ptr. (exploded_edge::add_edge): Likewise. * sm-signal.cc (register_signal_handler::impl_transition): Use make_unique. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-11-03analyzer: use std::unique_ptr for saved_diagnostic::m_stmt_finderDavid Malcolm4-13/+12
gcc/analyzer/ChangeLog: * diagnostic-manager.cc (saved_diagnostic::saved_diagnostic): Make stmt_finder const. (saved_diagnostic::~saved_diagnostic): Remove explicit delete of m_stmt_finder. (diagnostic_manager::add_diagnostic): Make stmt_finder const. * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Likewise. (saved_diagnostic::m_stmt_finder): Convert to std::unique_ptr. (diagnostic_manager::add_diagnostic): Make stmt_finder const. * engine.cc (impl_sm_context::impl_sm_context): Likewise. (impl_sm_context::m_stmt_finder): Likewise. (leak_stmt_finder::clone): Convert return type to std::unique_ptr. * exploded-graph.h (stmt_finder::clone): Likewise. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-11-03analyzer: use std::unique_ptr for pending_diagnostic/noteDavid Malcolm34-185/+257
gcc/analyzer/ChangeLog: * call-info.cc: Add define of INCLUDE_MEMORY. * call-summary.cc: Likewise. * checker-path.cc: Likewise. * constraint-manager.cc: Likewise. * diagnostic-manager.cc: Likewise. (saved_diagnostic::saved_diagnostic): Use std::unique_ptr for param d and field m_d. (saved_diagnostic::~saved_diagnostic): Remove explicit delete of m_d. (saved_diagnostic::add_note): Use std::unique_ptr for param pn. (saved_diagnostic::get_pending_diagnostic): Update for conversion of m_sd.m_d to unique_ptr. (diagnostic_manager::add_diagnostic): Use std::unique_ptr for param d. Remove explicit deletion. (diagnostic_manager::add_note): Use std::unique_ptr for param pn. (diagnostic_manager::emit_saved_diagnostic): Update for conversion of m_sd.m_d to unique_ptr. (null_assignment_sm_context::warn): Use std::unique_ptr for param d. Remove explicit deletion. * diagnostic-manager.h (saved_diagnostic::saved_diagnostic): Use std::unique_ptr for param d. (saved_diagnostic::add_note): Likewise for param pn. (saved_diagnostic::m_d): Likewise. (diagnostic_manager::add_diagnostic): Use std::unique_ptr for param d. (diagnostic_manager::add_note): Use std::unique_ptr for param pn. * engine.cc: Include "make-unique.h". (impl_region_model_context::warn): Update to use std::unique_ptr for param, removing explicit deletion. (impl_region_model_context::add_note): Likewise. (impl_sm_context::warn): Update to use std::unique_ptr for param. (impl_region_model_context::on_state_leak): Likewise for result of on_leak. (exploded_node::on_longjmp): Use make_unique when creating pending_diagnostic. (exploded_graph::process_node): Likewise. * exploded-graph.h (impl_region_model_context::warn): Update to use std::unique_ptr for param. (impl_region_model_context::add_note): Likewise. * feasible-graph.cc: Add define of INCLUDE_MEMORY. * pending-diagnostic.cc: Likewise. * pending-diagnostic.h: Include analyzer.sm.h" * program-point.cc: Add define of INCLUDE_MEMORY. * program-state.cc: Likewise. * region-model-asm.cc: Likewise. * region-model-impl-calls.cc: Likewise. Include "make-unique.h". (region_model::impl_call_putenv): Use make_unique when creating pending_diagnostic. * region-model-manager.cc: Add define of INCLUDE_MEMORY. * region-model-reachability.cc: Likewise. * region-model.cc: Likewise. Include "make-unique.h". (region_model::get_gassign_result): Use make_unique when creating pending_diagnostic. (region_model::check_for_poison): Likewise. (region_model::on_stmt_pre): Likewise. (region_model::check_symbolic_bounds): Likewise. (region_model::check_region_bounds): Likewise. (annotating_ctxt: make_note): Use std::unique_ptr for result. (region_model::deref_rvalue): Use make_unique when creating pending_diagnostic. (region_model::check_for_writable_region): Likewise. (region_model::check_region_size): Likewise. (region_model::check_dynamic_size_for_floats): Likewise. (region_model::maybe_complain_about_infoleak): Likewise. (noop_region_model_context::add_note): Use std::unique_ptr for param. Remove explicit deletion. * region-model.h: Include "analyzer/pending-diagnostic.h". (region_model_context::warn): Convert param to std::unique_ptr. (region_model_context::add_note): Likewise. (noop_region_model_context::warn): Likewise. (noop_region_model_context::add_note): Likewise. (region_model_context_decorator::warn): Likewise. (region_model_context_decorator::add_note): Likewise. (note_adding_context::warn): Likewise. (note_adding_context::make_note): Likewise for return type. (test_region_model_context::warn): Convert param to std::unique_ptr. * region.cc: Add define of INCLUDE_MEMORY. * sm-fd.cc: Likewise. Include "make-unique.h". (fd_state_machine::check_for_fd_attrs): Use make_unique when creating pending_diagnostics. (fd_state_machine::on_open): Likewise. (fd_state_machine::on_creat): Likewise. (fd_state_machine::check_for_dup): Likewise. (fd_state_machine::on_close): Likewise. (fd_state_machine::check_for_open_fd): Likewise. (fd_state_machine::on_leak): Likewise, converting return type to std::unique_ptr. * sm-file.cc: Add define of INCLUDE_MEMORY. Include "make-unique.h". (fileptr_state_machine::on_stmt): Use make_unique when creating pending_diagnostic. (fileptr_state_machine::on_leak): Likewise, converting return type to std::unique_ptr. * sm-malloc.cc: Add define of INCLUDE_MEMORY. Include "make-unique.h". (malloc_state_machine::on_stmt): Use make_unique when creating pending_diagnostic. (malloc_state_machine::handle_free_of_non_heap): Likewise. (malloc_state_machine::on_deallocator_call): Likewise. (malloc_state_machine::on_realloc_call): Likewise. (malloc_state_machine::on_leak): Likewise, converting return type to std::unique_ptr. * sm-pattern-test.cc: Add define of INCLUDE_MEMORY. Include "make-unique.h". (pattern_test_state_machine::on_condition): Use make_unique when creating pending_diagnostic. * sm-sensitive.cc: Add define of INCLUDE_MEMORY. Include "make-unique.h". (sensitive_state_machine::warn_for_any_exposure): Use make_unique when creating pending_diagnostic. * sm-signal.cc: Add define of INCLUDE_MEMORY. Include "make-unique.h". (signal_state_machine::on_stmt): Use make_unique when creating pending_diagnostic. * sm-taint.cc: Add define of INCLUDE_MEMORY. Include "make-unique.h". (taint_state_machine::check_for_tainted_size_arg): Use make_unique when creating pending_diagnostic. (taint_state_machine::check_for_tainted_divisor): Likewise. (region_model::check_region_for_taint): Likewise. (region_model::check_dynamic_size_for_taint): Likewise. * sm.cc: Add define of INCLUDE_MEMORY. Include "analyzer/pending-diagnostic.h". (state_machine::on_leak): Move here from sm.h, changing return type to std::unique_ptr. * sm.h (state_machine::on_leak): Change return type to std::unique_ptr. Move defn of base impl to sm.cc (sm_context::warn): Convert param d to std_unique_ptr. * state-purge.cc: Add define of INCLUDE_MEMORY. * store.cc: Likewise. * svalue.cc: Likewise. * trimmed-graph.cc: Likewise. * varargs.cc: Likewise. Include "make-unique.h". (va_list_state_machine::check_for_ended_va_list): Use make_unique when creating pending_diagnostic. (va_list_state_machine::on_leak): Likewise, converting return type to std::unique_ptr. (region_model::impl_call_va_arg): Use make_unique when creating pending_diagnostic. gcc/testsuite/ChangeLog: * gcc.dg/plugin/analyzer_gil_plugin.c: Add define of INCLUDE_MEMORY. Include "make-unique.h". (gil_state_machine::check_for_pyobject_in_call): Use make_unique when creating pending_diagnostic. (gil_state_machine::on_stmt): Likewise. (gil_state_machine::check_for_pyobject_usage_without_gil): Likewise. * gcc.dg/plugin/analyzer_kernel_plugin.c: : Add define of INCLUDE_MEMORY. * gcc.dg/plugin/analyzer_known_fns_plugin.c: Likewise. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-11-03analyzer: fix ICE when pipe's arg isn't a pointer [PR107486]David Malcolm3-4/+22
gcc/analyzer/ChangeLog: PR analyzer/107486 * analyzer.cc (is_pipe_call_p): New. * analyzer.h (is_pipe_call_p): New decl. * region-model.cc (region_model::on_call_pre): Use it. (region_model::on_call_post): Likewise. gcc/testsuite/ChangeLog: PR analyzer/107486 * gcc.dg/analyzer/pipe-pr107486.c: New test. * gcc.dg/analyzer/pipe-void-return.c: New test. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-10-27Daily bump.GCC Administrator1-0/+11
2022-10-26analyzer: fixes to file-descriptor handlingDavid Malcolm1-17/+17
gcc/analyzer/ChangeLog: * sm-fd.cc (fd_state_machine::on_open): Transition to "unchecked" when the mode is symbolic, rather than just on integer constants. (fd_state_machine::check_for_open_fd): Don't complain about unchecked values in the start state. gcc/testsuite/ChangeLog: * gcc.dg/analyzer/fd-3.c (test_5): Expect "opened here" message even when flags are symbolic. (test_read_from_symbolic_fd): New. (test_write_to_symbolic_fd): New. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-10-26analyzer: add sm-fd.dotDavid Malcolm1-0/+109
Add a .dot file to document the file descriptor state machine. gcc/analyzer/ChangeLog: * sm-fd.dot: New file. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-10-25Daily bump.GCC Administrator1-0/+65
2022-10-24analyzer: fix ICE on va_copy [PR107349]David Malcolm1-3/+2
gcc/analyzer/ChangeLog: PR analyzer/107349 * varargs.cc (get_va_copy_arg): Fix the non-pointer case. gcc/testsuite/ChangeLog: PR analyzer/107349 * gcc.dg/analyzer/stdarg-1-ms_abi.c (pr107349): New. * gcc.dg/analyzer/stdarg-1-sysv_abi.c (pr107349): New. * gcc.dg/analyzer/stdarg-1.c (pr107349): New. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-10-24analyzer: handle (NULL == &VAR) [PR107345]David Malcolm1-3/+12
gcc/analyzer/ChangeLog: PR analyzer/107345 * region-model.cc (region_model::eval_condition_without_cm): Ensure that constants are on the right-hand side before checking for them. gcc/testsuite/ChangeLog: PR analyzer/107345 * gcc.dg/analyzer/pr107345.c: New test. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-10-24analyzer: simplify sm_state_map lookupDavid Malcolm3-92/+48
gcc/analyzer/ChangeLog: * engine.cc (impl_region_model_context::get_malloc_map): Replace with... (impl_region_model_context::get_state_map_by_name): ...this. (impl_region_model_context::get_fd_map): Delete. (impl_region_model_context::get_taint_map): Delete. * exploded-graph.h (impl_region_model_context::get_fd_map): Delete. (impl_region_model_context::get_malloc_map): Delete. (impl_region_model_context::get_taint_map): Delete. (impl_region_model_context::get_state_map_by_name): New. * region-model.h (region_model_context::get_state_map_by_name): New vfunc. (region_model_context::get_fd_map): Convert from vfunc to function. (region_model_context::get_malloc_map): Likewise. (region_model_context::get_taint_map): Likewise. (noop_region_model_context::get_state_map_by_name): New. (noop_region_model_context::get_fd_map): Delete. (noop_region_model_context::get_malloc_map): Delete. (noop_region_model_context::get_taint_map): Delete. (region_model_context_decorator::get_state_map_by_name): New. (region_model_context_decorator::get_fd_map): Delete. (region_model_context_decorator::get_malloc_map): Delete. (region_model_context_decorator::get_taint_map): Delete. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-10-24analyzer: handle "pipe" and "pipe2" [PR106300]David Malcolm6-9/+196
gcc/analyzer/ChangeLog: PR analyzer/106300 * engine.cc (impl_region_model_context::get_fd_map): New. * exploded-graph.h (impl_region_model_context::get_fd_map): New decl. * region-model-impl-calls.cc (region_model::impl_call_pipe): New. * region-model.cc (region_model::update_for_int_cst_return): New, based on... (region_model::update_for_zero_return): ...this. Reimplement in terms of the former. (region_model::on_call_pre): Handle "pipe" and "pipe2". (region_model::on_call_post): Likewise. * region-model.h (region_model::impl_call_pipe): New decl. (region_model::update_for_int_cst_return): New decl. (region_model::mark_as_valid_fd): New decl. (region_model_context::get_fd_map): New pure virtual fn. (noop_region_model_context::get_fd_map): New. (region_model_context_decorator::get_fd_map): New. * sm-fd.cc: Include "analyzer/program-state.h". (fd_state_machine::describe_state_change): Handle transitions from start state to valid states. (fd_state_machine::mark_as_valid_fd): New. (fd_state_machine::on_stmt): Add missing return for "creat". (region_model::mark_as_valid_fd): New. gcc/ChangeLog: PR analyzer/106300 * doc/invoke.texi (Static Analyzer Options): Add "pipe" and "pipe2" to the list of functions the analyzer has hardcoded knowledge of. gcc/testsuite/ChangeLog: PR analyzer/106300 * gcc.dg/analyzer/pipe-1.c: New test. * gcc.dg/analyzer/pipe-glibc.c: New test. * gcc.dg/analyzer/pipe-manpages.c: New test. * gcc.dg/analyzer/pipe2-1.c: New test. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-10-20Daily bump.GCC Administrator1-0/+13
2022-10-19analyzer: fix ICE on __builtin_ms_va_copy [PR105765]David Malcolm1-16/+23
gcc/analyzer/ChangeLog: PR analyzer/105765 * varargs.cc (get_BT_VALIST_ARG): Rename to... (get_va_copy_arg): ...this, and update logic for determining level of indirection of va_copy's argument to use type of argument, rather than looking at va_list_type_node, to correctly handle __builtin_ms_va_copy. (get_stateful_BT_VALIST_ARG): Rename to... (get_stateful_va_copy_arg): ...this. (va_list_state_machine::on_va_copy): Update for renaming. (region_model::impl_call_va_copy): Likewise. gcc/testsuite/ChangeLog: PR analyzer/105765 * gcc.dg/analyzer/stdarg-1-ms_abi.c: New test, based on stdarg-1.c. * gcc.dg/analyzer/stdarg-1-sysv_abi.c: Likewise. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-10-14Daily bump.GCC Administrator1-0/+6
2022-10-13analyzer: fix ICE introduced in r13-3168 [PR107210]David Malcolm1-1/+2
gcc/analyzer/ChangeLog: PR analyzer/107210 * svalue.cc (constant_svalue::maybe_fold_bits_within): Only attempt to extract individual bits when tree_fits_uhwi_p. gcc/testsuite/ChangeLog: PR analyzer/107210 * gfortran.dg/analyzer/pr107210.f90: New test. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-10-08Daily bump.GCC Administrator1-0/+9
2022-10-07analyzer: extract bits from integer constants [PR105783]David Malcolm2-1/+68
Fix a false positive from -Wanalyzer-null-dereference due to -fanalyzer failing to grok the value of a particular boolean field initialized to a constant. gcc/analyzer/ChangeLog: PR analyzer/105783 * region-model.cc (selftest::get_bit): New function. (selftest::test_bits_within_svalue_folding): New. (selfftest::analyzer_region_model_cc_tests): Call it. * svalue.cc (constant_svalue::maybe_fold_bits_within): Handle the case of extracting a single bit. gcc/testsuite/ChangeLog: PR analyzer/105783 * gcc.dg/analyzer/pr105783.c: New test. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-10-07Daily bump.GCC Administrator1-0/+14
2022-10-06analyzer: fix another ICE in PR 107158David Malcolm1-28/+6
I overreduced PR analyzer/107158 in r13-3096-gef878564140cbc, and there was another ICE in the original reproducer, which this patch fixes. gcc/analyzer/ChangeLog: PR analyzer/107158 * store.cc (store::replay_call_summary_cluster): Eliminate special-casing of RK_HEAP_ALLOCATED in favor of sharing code with RK_DECL, avoiding an ICE due to attempting to bind a compound_svalue into a binding_cluster when an svalue in the summary cluster converts to a compound_svalue in the caller. gcc/testsuite/ChangeLog: PR analyzer/107158 * gcc.dg/analyzer/call-summaries-pr107158-2.c: New test. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-10-06analyzer: fixes to call_summary_replay::dump_to_ppDavid Malcolm1-2/+8
gcc/analyzer/ChangeLog: * call-summary.cc (call_summary_replay::dump_to_pp): Bulletproof against NULL caller regions/svalues. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-10-06Daily bump.GCC Administrator1-0/+179
2022-10-05analyzer: simplify some includesDavid Malcolm41-180/+8
gcc/analyzer/ChangeLog: * analysis-plan.cc: Simplify includes. * analyzer-pass.cc: Likewise. * analyzer-selftests.cc: Likewise. * analyzer.cc: Likewise. * analyzer.h: Add includes of "json.h" and "tristate.h". * call-info.cc: Simplify includes. * call-string.cc: Likewise. * call-summary.cc: Likewise. * checker-path.cc: Likewise. * complexity.cc: Likewise. * constraint-manager.cc: Likewise. * diagnostic-manager.cc: Likewise. * engine.cc: Likewise. * feasible-graph.cc: Likewise. * known-function-manager.cc: Likewise. * pending-diagnostic.cc: Likewise. * program-point.cc: Likewise. * program-state.cc: Likewise. * region-model-asm.cc: Likewise. * region-model-impl-calls.cc: Likewise. * region-model-manager.cc: Likewise. * region-model-reachability.cc: Likewise. * region-model.cc: Likewise. * region-model.h: Include "selftest.h". * region.cc: Simplify includes. * sm-fd.cc: Likewise. * sm-file.cc: Likewise. * sm-malloc.cc: Likewise. * sm-pattern-test.cc: Likewise. * sm-sensitive.cc: Likewise. * sm-signal.cc: Likewise. * sm-taint.cc: Likewise. * sm.cc: Likewise. * state-purge.cc: Likewise. * store.cc: Likewise. * store.h: Likewise. * supergraph.cc: Likewise. * svalue.cc: Likewise. * svalue.h: Likewise. * trimmed-graph.cc: Likewise. * varargs.cc: Likewise. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-10-05analyzer: fix ICEs seen with call summaries on PR 107060David Malcolm6-15/+48
This doesn't fix the various false positives seen with -fanalyzer-call-summaries on PR 107060, but stops it crashing at -O2. gcc/analyzer/ChangeLog: PR analyzer/107060 * call-summary.cc (call_summary_replay::convert_svalue_from_summary_1): Handle NULL results from convert_svalue_from_summary in SK_UNARY_OP and SK_BIN_OP. * engine.cc (impl_region_model_context::on_unknown_change): Bail out on svalues that can't have associated state. * region-model-impl-calls.cc (region_model::impl_call_analyzer_get_unknown_ptr): New. * region-model.cc (region_model::on_stmt_pre): Handle "__analyzer_get_unknown_ptr". * region-model.h (region_model::impl_call_analyzer_get_unknown_ptr): New decl. * store.cc (store::replay_call_summary_cluster): Avoid trying to create binding clusters for base regions that shouldn't have them. gcc/ChangeLog: PR analyzer/107060 * doc/analyzer.texi (__analyzer_get_unknown_ptr): Document. gcc/testsuite/ChangeLog: PR analyzer/107060 * gcc.dg/analyzer/analyzer-decls.h (__analyzer_get_unknown_ptr): New decl. * gcc.dg/analyzer/call-summaries-2.c (test_summarized_writes_param_to_ptr_unknown): New test. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-10-05analyzer: remove unused variablesMartin Liska4-8/+1
Fixes: gcc/analyzer/call-summary.h:103:13: warning: private field 'm_called_fn' is not used [-Wunused-private-field] gcc/analyzer/engine.cc:1631:24: warning: unused parameter 'uncertainty' [-Wunused-parameter] gcc/analyzer/ChangeLog: * call-summary.cc (call_summary_replay::call_summary_replay): Remove unused variable and arguments. * call-summary.h: Likewise. * engine.cc (exploded_node::on_stmt): Likewise. (exploded_node::replay_call_summaries): Likewise. (exploded_node::replay_call_summary): Likewise. * exploded-graph.h (class exploded_node): Likewise.
2022-10-04analyzer: revamp side-effects of call summaries [PR107072]David Malcolm23-54/+1613
With -fanalyzer-call-summaries the analyzer canl attempt to summarize the effects of some function calls at their call site, rather than simulate the call directly, which can avoid big slowdowns during analysis. Previously, this summarization was extremely simplistic: no attempt was made to update sm-state, and region_model::update_for_call_summary would simply set the return value of the function to UNKNOWN, and assume the function had no side effects. This patch implements less simplistic summarizations: it tracks each possible return enode from the called function, and attempts to generate a successor enode from the callsite for each that have compatible conditions, mapping state changes in the summary to state changes at the callsite. It also implements the beginnings of heuristics for generating user-facing descriptions of a summary e.g. "when 'foo' returns NULL" versus: "when 'foo' returns a heap-allocated buffer" This still has some bugs, but much more accurately tracks the effects of a call, and so is an improvement; it should only have an effect when -fanalyzer-call-summaries is enabled. As before, -fanalyzer-call-summaries is disabled by default in analyzer.opt (but enabled by default in the test suite). gcc/ChangeLog: PR analyzer/107072 * Makefile.in (ANALYZER_OBJS): Add analyzer/call-summary.o. gcc/analyzer/ChangeLog: PR analyzer/107072 * analyzer-logging.h: Include "diagnostic-core.h". * analyzer.h: Include "function.h". (class call_summary): New forward decl. (class call_summary_replay): New forward decl. (struct per_function_data): New forward decl. (struct interesting_t): New forward decl. (custom_edge_info::update_state): New vfunc. * call-info.cc (custom_edge_info::update_state): New. * call-summary.cc: New file. * call-summary.h: New file. * constraint-manager.cc: Include "analyzer/call-summary.h". (class replay_fact_visitor): New. (constraint_manager::replay_call_summary): New. * constraint-manager.h (constraint_manager::replay_call_summary): New. * engine.cc: Include "analyzer/call-summary.h". (exploded_node::on_stmt): Handle call summaries. (class call_summary_edge_info): New. (exploded_node::replay_call_summaries): New. (exploded_node::replay_call_summary): New. (per_function_data::~per_function_data): New. (per_function_data::add_call_summary): Move here from header and reimplement. (exploded_graph::process_node): Call update_state rather than update_model when handling bifurcation (viz_callgraph_node::dump_dot): Use a regular label rather than an HTML table; add summaries to dump. * exploded-graph.h: Include "alloc-pool.h", "fibonacci_heap.h", "supergraph.h", "sbitmap.h", "shortest-paths.h", "analyzer/sm.h", "analyzer/program-state.h", and "analyzer/diagnostic-manager.h". (exploded_node::replay_call_summaries): New decl. (exploded_node::replay_call_summary): New decl. (per_function_data::~per_function_data): New decl. (per_function_data::add_call_summary): Move implemention from header. (per_function_data::m_summaries): Update type of element. * known-function-manager.h: Include "analyzer/analyzer-logging.h". * program-point.h: Include "pretty-print.h" and "analyzer/call-string.h". * program-state.cc: Include "analyzer/call-summary.h". (sm_state_map::replay_call_summary): New. (program_state::replay_call_summary): New. * program-state.h (sm_state_map::replay_call_summary): New decl. (program_state::replay_call_summary): New decl. * region-model-manager.cc (region_model_manager::get_or_create_asm_output_svalue): New overload. * region-model-manager.h (region_model_manager::get_or_create_asm_output_svalue): New overload decl. * region-model.cc: Include "analyzer/call-summary.h". (region_model::maybe_update_for_edge): Remove call to region_model::update_for_call_summary on SUPEREDGE_INTRAPROCEDURAL_CALL. (region_model::update_for_call_summary): Delete. (region_model::replay_call_summary): New. * region-model.h (region_model::replay_call_summary): New decl. (region_model::update_for_call_summary): Delete decl. * store.cc: Include "analyzer/call-summary.h". (store::replay_call_summary): New. (store::replay_call_summary_cluster): New. * store.h: Include "tristate.h". (is_a_helper <const ana::concrete_binding *>::test): New. (store::replay_call_summary): New decl. (store::replay_call_summary_cluster): New decl. * supergraph.cc (get_ultimate_function_for_cgraph_edge): Remove "static" from decl. (supergraph_call_edge): Make stmt param const. * supergraph.h: Include "ordered-hash-map.h", "cfg.h", "basic-block.h", "gimple.h", "gimple-iterator.h", and "digraph.h". (supergraph_call_edge): Make stmt param const. (get_ultimate_function_for_cgraph_edge): New decl. * svalue.cc (compound_svalue::compound_svalue): Assert that we're not nesting compound_svalues. * svalue.h: Include "json.h", "analyzer/store.h", and "analyzer/program-point.h". (asm_output_svalue::get_num_outputs): New accessor. gcc/testsuite/ChangeLog: PR analyzer/107072 * gcc.dg/analyzer/call-summaries-2.c: New test. * gcc.dg/analyzer/call-summaries-3.c: New test. * gcc.dg/analyzer/call-summaries-asm-x86.c: New test. * gcc.dg/analyzer/call-summaries-malloc.c: New test. * gcc.dg/analyzer/call-summaries-pr107072.c: New test. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-10-04analyzer: move region_model_manager decl to its own headerDavid Malcolm2-288/+313
gcc/analyzer/ChangeLog: * region-model.h: Include "analyzer/region-model-manager.h" (class region_model_manager): Move decl to... * region-model-manager.h: ...this new file. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-10-04analyzer: fold -(-(VAL)) to VALDavid Malcolm1-0/+11
gcc/analyzer/ChangeLog: * region-model-manager.cc (region_model_manager::maybe_fold_unaryop): Fold -(-(VAL)) to VAL. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-10-04analyzer: widening_svalues take a function_point rather than a program_pointDavid Malcolm5-12/+17
Enabling work towrads better call summarization. gcc/analyzer/ChangeLog: * region-model-manager.cc (region_model_manager::get_or_create_widening_svalue): Use a function_point rather than a program_point. * region-model.cc (selftest::test_widening_constraints): Likewise. * region-model.h (region_model_manager::get_or_create_widening_svalue): Likewise. (model_merger::get_function_point): New. * svalue.cc (svalue::can_merge_p): Use a function_point rather than a program_point. (svalue::can_merge_p): Likewise. * svalue.h (widening_svalue::key_t): Likewise. (widening_svalue::widening_svalue): Likewise. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-09-13Daily bump.GCC Administrator1-0/+5
2022-09-12analyzer: remove unused fieldsMartin Liska1-9/+3
Fixes: gcc/analyzer/region-model.cc:5918:8: warning: private field 'm_record_type' is not used [-Wunused-private-field] gcc/analyzer/region-model.cc:6305:25: warning: private field 'm_mgr' is not used [-Wunused-private-field] gcc/analyzer/ChangeLog: * region-model.cc (region_model::maybe_complain_about_infoleak): Remove unused fields.
2022-09-12Daily bump.GCC Administrator1-0/+14
2022-09-11analyzer: consider empty ranges and zero byte accesses [PR106845]Tim Lange3-2/+25
This patch adds handling of empty ranges in bit_range and byte_range and adds an assertion to member functions that assume a positive size. Further, the patch fixes an ICE caused by an empty byte_range passed to byte_range::exceeds_p. Regression-tested on Linux x86_64. 2022-09-10 Tim Lange <mail@tim-lange.me> gcc/analyzer/ChangeLog: PR analyzer/106845 * region-model.cc (region_model::check_region_bounds): Bail out if 0 bytes were accessed. * store.cc (byte_range::dump_to_pp): Add special case for empty ranges. (byte_range::exceeds_p): Restrict to non-empty ranges. (byte_range::falls_short_of_p): Restrict to non-empty ranges. * store.h (bit_range::empty_p): New function. (bit_range::get_last_byte_offset): Restrict to non-empty ranges. (byte_range::empty_p): New function. (byte_range::get_last_byte_offset): Restrict to non-empty ranges. gcc/testsuite/ChangeLog: PR analyzer/106845 * gcc.dg/analyzer/out-of-bounds-zero.c: New test. * gcc.dg/analyzer/pr106845.c: New test.
2022-09-10Daily bump.GCC Administrator1-0/+68
2022-09-09analyzer: implement trust boundaries via a plugin for Linux kernelDavid Malcolm8-31/+746
This is a less ambitious version of: [PATCH 0/6] RFC: adding support to GCC for detecting trust boundaries https://gcc.gnu.org/pipermail/gcc-patches/2021-November/584372.html Earlier versions of this patch attempted: (a) various ways of identifying "untrusted" memory regions (b) providing a way to support the Linux kernel's "__user" annotation, either via type attributes, or via custom address spaces (c) enough attributes to identify "copy_from_user" and "copy_to_user", (d) wiring all of the above together to detect infoleaks and taint This patch adds a new -Wanalyzer-exposure-through-uninit-copy, emitted by -fanalyzer if it detects copying of uninitialized data through a pointer to an untrusted region, but requires a plugin to tell it when a copy crosses a trust boundary. This patch adds a proof-of-concept gcc plugin for the analyzer for use with the Linux kernel that special-cases calls to "copy_from_user" and calls to "copy_to_user": calls to copy_to_user are checked for -Wanalyzer-exposure-through-uninit-copy, and data copied via copy_from_user is marked as tainted when -fanalyzer-checker=taint is active. This is very much just a proof-of-concept. A big limitation is that the copy_{from,to}_user special-casing only happens if these functions have no body in the TU being analyzed, which isn't the case for a normal kernel build. I'd much prefer to provide a more general mechanism for handling such behavior without resorting to plugins (e.g. via attributes or custom address spaces), but in the interest of not "letting perfect be the enemy of the good" this patch at least allows parts of this "trust boundaries" code to be merged for experimentation with the idea. The -Wanalyzer-exposure-through-uninit-copy diagnostic uses notes to express what fields and padding within a struct have not been initialized. For example: infoleak-CVE-2011-1078-2.c: In function 'test_1': infoleak-CVE-2011-1078-2.c:32:9: warning: potential exposure of sensitive information by copying uninitialized data from stack across trust boundary [CWE-200] [-Wanalyzer-exposure-through-uninit-copy] 32 | copy_to_user(optval, &cinfo, sizeof(cinfo)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 'test_1': events 1-3 | | 25 | struct sco_conninfo cinfo; | | ^~~~~ | | | | | (1) region created on stack here | | (2) capacity: 6 bytes |...... | 32 | copy_to_user(optval, &cinfo, sizeof(cinfo)); | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (3) uninitialized data copied from stack here | infoleak-CVE-2011-1078-2.c:32:9: note: 1 byte is uninitialized 32 | copy_to_user(optval, &cinfo, sizeof(cinfo)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ infoleak-CVE-2011-1078-2.c:18:15: note: padding after field 'dev_class' is uninitialized (1 byte) 18 | __u8 dev_class[3]; | ^~~~~~~~~ infoleak-CVE-2011-1078-2.c:25:29: note: suggest forcing zero-initialization by providing a '{0}' initializer 25 | struct sco_conninfo cinfo; | ^~~~~ | = {0} For taint-detection, the patch includes a series of reproducers for detecting CVE-2011-0521. Unfortunately the analyzer doesn't yet detect the issue until the code has been significantly simplified from its original form: currently only in -5.c and -6.c in the series of test (see notes in the individual cases), such as: taint-CVE-2011-0521-6.c:33:48: warning: use of attacker-controlled value '*info.num' in array lookup without bounds checking [CWE-129] [-Wanalyzer-tainted-array-index] 33 | av7110->ci_slot[info->num].num = info->num; | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~ 'test_1': events 1-3 | | 19 | if (copy_from_user(&sbuf, (void __user *)arg, sizeof(sbuf)) != 0) | | ^ | | | | | (1) following 'false' branch... |...... | 23 | struct dvb_device *dvbdev = file->private_data; | | ~~~~~~ | | | | | (2) ...to here |...... | 33 | av7110->ci_slot[info->num].num = info->num; | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (3) use of attacker-controlled value '*info.num' in array lookup without bounds checking | The patch also includes various infoleak and taint cases from my antipatterns.ko kernel module: https://github.com/davidmalcolm/antipatterns.ko gcc/analyzer/ChangeLog: * analyzer.opt (Wanalyzer-exposure-through-uninit-copy): New. * checker-path.cc (region_creation_event::region_creation_event): Add "capacity" and "kind" params. (region_creation_event::get_desc): Generalize to different kinds of event. (checker_path::add_region_creation_event): Convert to... (checker_path::add_region_creation_events): ...this. * checker-path.h (enum rce_kind): New. (region_creation_event::region_creation_event): Add "capacity" and "kind" params. (region_creation_event::m_capacity): New field. (region_creation_event::m_rce_kind): New field. (checker_path::add_region_creation_event): Convert to... (checker_path::add_region_creation_events): ...this. * diagnostic-manager.cc (diagnostic_manager::build_emission_path): Update for multiple region creation events. (diagnostic_manager::add_event_on_final_node): Likewise. (diagnostic_manager::add_events_for_eedge): Likewise. * region-model-impl-calls.cc (call_details::get_logger): New. * region-model.cc: Define INCLUDE_MEMORY before including "system.h". Include "gcc-rich-location.h". (class record_layout): New. (class exposure_through_uninit_copy): New. (contains_uninit_p): New. (region_model::maybe_complain_about_infoleak): New. * region-model.h (call_details::get_logger): New decl. (region_model::maybe_complain_about_infoleak): New decl. (region_model::mark_as_tainted): New decl. * sm-taint.cc (region_model::mark_as_tainted): New. gcc/ChangeLog: * doc/invoke.texi (Static Analyzer Options): Add -Wanalyzer-exposure-through-uninit-copy. gcc/testsuite/ChangeLog: * gcc.dg/plugin/analyzer_kernel_plugin.c: New test. * gcc.dg/plugin/copy_from_user-1.c: New test. * gcc.dg/plugin/infoleak-1.c: New test. * gcc.dg/plugin/infoleak-2.c: New test. * gcc.dg/plugin/infoleak-3.c: New test. * gcc.dg/plugin/infoleak-CVE-2011-1078-1.c: New test. * gcc.dg/plugin/infoleak-CVE-2011-1078-2.c: New test. * gcc.dg/plugin/infoleak-CVE-2014-1446-1.c: New test. * gcc.dg/plugin/infoleak-CVE-2017-18549-1.c: New test. * gcc.dg/plugin/infoleak-CVE-2017-18550-1.c: New test. * gcc.dg/plugin/infoleak-antipatterns-1.c: New test. * gcc.dg/plugin/infoleak-fixit-1.c: New test. * gcc.dg/plugin/infoleak-net-ethtool-ioctl.c: New test. * gcc.dg/plugin/infoleak-vfio_iommu_type1.c: New test. * gcc.dg/plugin/plugin.exp (plugin_test_list): Add analyzer_kernel_plugin.c and the new test cases. * gcc.dg/plugin/taint-CVE-2011-0521-1-fixed.c: New test. * gcc.dg/plugin/taint-CVE-2011-0521-1.c: New test. * gcc.dg/plugin/taint-CVE-2011-0521-2-fixed.c: New test. * gcc.dg/plugin/taint-CVE-2011-0521-2.c: New test. * gcc.dg/plugin/taint-CVE-2011-0521-3-fixed.c: New test. * gcc.dg/plugin/taint-CVE-2011-0521-3.c: New test. * gcc.dg/plugin/taint-CVE-2011-0521-4.c: New test. * gcc.dg/plugin/taint-CVE-2011-0521-5-fixed.c: New test. * gcc.dg/plugin/taint-CVE-2011-0521-5.c: New test. * gcc.dg/plugin/taint-CVE-2011-0521-6.c: New test. * gcc.dg/plugin/taint-CVE-2011-0521.h: New test. * gcc.dg/plugin/taint-antipatterns-1.c: New test. * gcc.dg/plugin/test-uaccess.h: New header for tests. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-09-09analyzer: add support for plugin-supplied known function behaviorsDavid Malcolm7-2/+283
This patch adds the ability for plugins to register "known functions" with the analyzer, identified by name. If -fanalyzer sees a call to such a function (with no body), it will use a plugin-provided subclass of the new known_function abstract base class to model the possible outcomes of the function call. gcc/ChangeLog: * Makefile.in (ANALYZER_OBJS): Add analyzer/known-function-manager.o. gcc/analyzer/ChangeLog: * analyzer.h (class known_function_manager): New forward decl. (class known_function): New. (plugin_analyzer_init_iface::register_known_function): New. * engine.cc: Include "analyzer/known-function-manager.h". (plugin_analyzer_init_impl::plugin_analyzer_init_impl): Add known_fn_mgr param. (plugin_analyzer_init_impl::register_state_machine): Add LOC_SCOPE. (plugin_analyzer_init_impl::register_known_function): New. (plugin_analyzer_init_impl::m_known_fn_mgr): New. (impl_run_checkers): Update plugin callback invocation to use eng's known_function_manager. * known-function-manager.cc: New file. * known-function-manager.h: New file. * region-model-manager.cc (region_model_manager::region_model_manager): Pass logger to m_known_fn_mgr's ctor. * region-model.cc (region_model::update_for_zero_return): New. (region_model::update_for_nonzero_return): New. (maybe_simplify_upper_bound): New. (region_model::maybe_get_copy_bounds): New. (region_model::get_known_function): New. (region_model::on_call_pre): Handle plugin-supplied known functions. * region-model.h: Include "analyzer/known-function-manager.h". (region_model_manager::get_known_function_manager): New. (region_model_manager::m_known_fn_mgr): New. (call_details::get_model): New accessor. (region_model::maybe_get_copy_bounds): New decl. (region_model::update_for_zero_return): New decl. (region_model::update_for_nonzero_return): New decl. (region_model::get_known_function): New decl. (region_model::get_known_function_manager): New. gcc/testsuite/ChangeLog: * gcc.dg/plugin/analyzer_known_fns_plugin.c: New test plugin. * gcc.dg/plugin/known-fns-1.c: New test. * gcc.dg/plugin/plugin.exp (plugin_test_list): Add the new plugin and test. Signed-off-by: David Malcolm <dmalcolm@redhat.com>
2022-09-09Daily bump.GCC Administrator1-0/+51
2022-09-08analyzer: support for symbolic values in the out-of-bounds checker [PR106625]Tim Lange7-90/+616
This patch adds support for reasoning about the inequality of two symbolic values in the special case specifically suited for reasoning about out-of-bounds past the end of the buffer. With this patch, the analyzer catches off-by-one errors and more even when the offset and capacity is symbolic. Regrtested on Linux x86_64 and tested on coreutils, curl, httpd and openssh as usual. 2022-09-07 Tim Lange <mail@tim-lange.me> gcc/analyzer/ChangeLog: PR analyzer/106625 * analyzer.h (region_offset): Eliminate m_is_symbolic member. * region-model-impl-calls.cc (region_model::impl_call_realloc): Refine implementation to be more precise. * region-model.cc (class symbolic_past_the_end): Abstract diagnostic class to complain about accesses past the end with symbolic values. (class symbolic_buffer_overflow): Concrete diagnostic class to complain about buffer overflows with symbolic values. (class symbolic_buffer_overread): Concrete diagnostic class to complain about buffer overreads with symbolic values. (region_model::check_symbolic_bounds): New function. (maybe_get_integer_cst_tree): New helper function. (region_model::check_region_bounds): Add call to check_symbolic_bounds if offset is not concrete. (region_model::eval_condition_without_cm): Add support for EQ_EXPR and GT_EXPR with binaryop_svalues. (is_positive_svalue): New hleper function. (region_model::symbolic_greater_than): New function to handle GT_EXPR comparisons with symbolic values. (region_model::structural_equality): New function to compare whether two svalues are structured the same, i.e. evaluate to the same value. (test_struct): Reflect changes to region::calc_offset. (test_var): Likewise. (test_array_2): Likewise and add selftest with symbolic i. * region-model.h (class region_model): Add check_symbolic_bounds, symbolic_greater_than and structural_equality. * region.cc (region::get_offset): Reflect changes to region::calc_offset. (region::calc_offset): Compute the symbolic offset if the offset is not concrete. (region::get_relative_symbolic_offset): New function to return the symbolic offset in bytes relative to its parent. (field_region::get_relative_symbolic_offset): Likewise. (element_region::get_relative_symbolic_offset): Likewise. (offset_region::get_relative_symbolic_offset): Likewise. (bit_range_region::get_relative_symbolic_offset): Likewise. * region.h: Add get_relative_symbolic_offset. * store.cc (binding_key::make): Reflect changes to region::calc_offset. (binding_map::apply_ctor_val_to_range): Likewise. (binding_map::apply_ctor_pair_to_child_region): Likewise. (binding_cluster::bind_compound_sval): Likewise. (binding_cluster::get_any_binding): Likewise. (binding_cluster::maybe_get_compound_binding): Likewise. gcc/ChangeLog: PR analyzer/106625 * doc/invoke.texi: State that the checker also reasons about symbolic values. gcc/testsuite/ChangeLog: PR analyzer/106625 * gcc.dg/analyzer/data-model-1.c: Change expected result. * gcc.dg/analyzer/out-of-bounds-5.c: New test. * gcc.dg/analyzer/out-of-bounds-realloc-grow.c: New test. * gcc.dg/analyzer/symbolic-gt-1.c: New test.
2022-09-06Daily bump.GCC Administrator1-0/+14
2022-09-05analyzer: strcpy semanticsTim Lange3-3/+45
This patch adds modelling for the semantics of strcpy in the simple case where the analyzer is able to infer a concrete string size. Regrtested on Linux x86_64. 2022-09-04 Tim Lange <mail@tim-lange.me> gcc/analyzer/ChangeLog: * region-model-impl-calls.cc (region_model::impl_call_strcpy): Handle the constant string case. * region-model.cc (region_model::get_string_size): New function to get the string size from a region or svalue. * region-model.h (class region_model): Add get_string_size. gcc/testsuite/ChangeLog: * gcc.dg/analyzer/out-of-bounds-4.c: New test. * gcc.dg/analyzer/strcpy-3.c: New test.
2022-09-05analyzer: return a concrete offset for cast_regionsTim Lange2-0/+12
This patch fixes a bug where maybe_fold_sub_svalue did not fold the access of a single char from a string to a char when the offset was zero because get_relative_concrete_offset did return false for cast_regions. Regrtested on Linux x86_64. 2022-09-04 Tim Lange <mail@tim-lange.me> gcc/analyzer/ChangeLog: * region.cc (cast_region::get_relative_concrete_offset): New overloaded method. * region.h: Add cast_region::get_relative_concrete_offset. gcc/testsuite/ChangeLog: * gcc.dg/analyzer/fold-string-to-char.c: New test.
generated by cgit v1.1 at 2025-06-01 22:17:28 +0000