xref: /freebsd-13-stable/contrib/llvm-project/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td (revision fbc266465ed3585efdbd8e9ebf71e97ce7e8b464) 
1//===--- Checkers.td - Static Analyzer Checkers -===-----------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8
9include "CheckerBase.td"
10
11//===----------------------------------------------------------------------===//
12// Packages.
13//===----------------------------------------------------------------------===//
14
15// The Alpha package is for checkers that have too many false positives to be
16// turned on by default. The hierarchy under Alpha should be organized in the
17// hierarchy checkers would have had if they were truly at the top level.
18// (For example, a Cocoa-specific checker that is alpha should be in
19// alpha.osx.cocoa).
20def Alpha : Package<"alpha">;
21
22def Core : Package<"core">;
23def CoreBuiltin : Package<"builtin">, ParentPackage<Core>, Hidden;
24def CoreUninitialized  : Package<"uninitialized">, ParentPackage<Core>;
25def CoreAlpha : Package<"core">, ParentPackage<Alpha>;
26
27// The OptIn package is for checkers that are not alpha and that would normally
28// be on by default but where the driver does not have enough information to
29// determine when they are applicable. For example, localizability checkers fit
30// this criterion because the driver cannot determine whether a project is
31// localized or not -- this is best determined at the IDE or build-system level.
32//
33// The checker hierarchy under OptIn should mirror that in Alpha: checkers
34// should be organized as if they were at the top level.
35//
36// Note: OptIn is *not* intended for checkers that are too noisy to be on by
37// default. Such checkers belong in the alpha package.
38def OptIn : Package<"optin">;
39
40def CoreOptIn : Package<"core">, ParentPackage<OptIn>;
41
42// In the Portability package reside checkers for finding code that relies on
43// implementation-defined behavior. Such checks are wanted for cross-platform
44// development, but unwanted for developers who target only a single platform.
45def PortabilityOptIn : Package<"portability">, ParentPackage<OptIn>;
46
47// Optional checkers related to taint security analysis.
48def TaintOptIn : Package<"taint">, ParentPackage<OptIn>;
49
50def Nullability : Package<"nullability">,
51  PackageOptions<[
52    CmdLineOption<Boolean,
53                  "NoDiagnoseCallsToSystemHeaders",
54                  "Suppresses warnings for violating nullability annotations "
55                  "of system header functions. This is useful if you are "
56                  "concerned with your custom nullability annotations more "
57                  "than with following nullability specifications of system "
58                  "header functions.",
59                  "false",
60                  Released>
61  ]>;
62
63def Cplusplus : Package<"cplusplus">;
64def CplusplusAlpha : Package<"cplusplus">, ParentPackage<Alpha>;
65def CplusplusOptIn : Package<"cplusplus">, ParentPackage<OptIn>;
66
67def Valist : Package<"valist">;
68
69def DeadCode : Package<"deadcode">;
70def DeadCodeAlpha : Package<"deadcode">, ParentPackage<Alpha>;
71
72def Performance : Package<"performance">, ParentPackage<OptIn>;
73
74def Security : Package <"security">;
75def InsecureAPI : Package<"insecureAPI">, ParentPackage<Security>;
76def SecurityAlpha : Package<"security">, ParentPackage<Alpha>;
77def Taint : Package<"taint">, ParentPackage<SecurityAlpha>;
78
79def CERT : Package<"cert">, ParentPackage<Security>;
80def ENV : Package<"env">, ParentPackage<CERT>;
81
82def CERTAlpha : Package<"cert">, ParentPackage<SecurityAlpha>;
83def POSAlpha : Package<"pos">, ParentPackage<CERTAlpha>;
84
85def Unix : Package<"unix">;
86def UnixAlpha : Package<"unix">, ParentPackage<Alpha>;
87def CString : Package<"cstring">, ParentPackage<Unix>;
88def CStringAlpha : Package<"cstring">, ParentPackage<UnixAlpha>;
89
90def OSX : Package<"osx">;
91def OSXAlpha : Package<"osx">, ParentPackage<Alpha>;
92def OSXOptIn : Package<"osx">, ParentPackage<OptIn>;
93
94def Cocoa : Package<"cocoa">, ParentPackage<OSX>;
95def CocoaAlpha : Package<"cocoa">, ParentPackage<OSXAlpha>;
96def CocoaOptIn : Package<"cocoa">, ParentPackage<OSXOptIn>;
97
98def CoreFoundation : Package<"coreFoundation">, ParentPackage<OSX>;
99def Containers : Package<"containers">, ParentPackage<CoreFoundation>;
100
101def LocalizabilityAlpha : Package<"localizability">, ParentPackage<CocoaAlpha>;
102def LocalizabilityOptIn : Package<"localizability">, ParentPackage<CocoaOptIn>;
103
104def MPI : Package<"mpi">, ParentPackage<OptIn>;
105
106def LLVM : Package<"llvm">;
107def LLVMAlpha : Package<"llvm">, ParentPackage<Alpha>;
108
109// The APIModeling package is for checkers that model APIs and don't perform
110// any diagnostics. These checkers are always turned on; this package is
111// intended for API modeling that is not controlled by the target triple.
112def APIModeling : Package<"apiModeling">, Hidden;
113def APIModelingAlpha : Package<"apiModeling">, ParentPackage<Alpha>, Hidden;
114
115def GoogleAPIModeling : Package<"google">, ParentPackage<APIModeling>, Hidden;
116def LLVMAPIModeling : Package<"llvm">, ParentPackage<APIModeling>, Hidden;
117
118def Debug : Package<"debug">, Hidden;
119
120def CloneDetectionAlpha : Package<"clone">, ParentPackage<Alpha>;
121
122def NonDeterminismAlpha : Package<"nondeterminism">, ParentPackage<Alpha>;
123
124def Fuchsia : Package<"fuchsia">;
125def FuchsiaAlpha : Package<"fuchsia">, ParentPackage<Alpha>;
126
127def WebKit : Package<"webkit">;
128def WebKitAlpha : Package<"webkit">, ParentPackage<Alpha>;
129
130//===----------------------------------------------------------------------===//
131// Core Checkers.
132//===----------------------------------------------------------------------===//
133
134let ParentPackage = Core in {
135
136def BitwiseShiftChecker : Checker<"BitwiseShift">,
137  HelpText<"Finds cases where bitwise shift operation causes undefined behaviour.">,
138  CheckerOptions<[
139    CmdLineOption<Boolean,
140                  "Pedantic",
141                  "If set to true, the checker reports undefined behavior even "
142                  "if it is supported by most compilers. (This flag has no "
143                  "effect in C++20 where these constructs are legal.)",
144                  "false",
145                  Released>,
146  ]>,
147  Documentation<HasDocumentation>;
148
149def CallAndMessageModeling : Checker<"CallAndMessageModeling">,
150  HelpText<"Responsible for essential modeling and assumptions after a "
151           "function/method call. For instance, if we can't reason about the "
152           "nullability of the implicit this parameter after a method call, "
153           "this checker conservatively assumes it to be non-null">,
154  Documentation<HasDocumentation>,
155  Hidden;
156
157def CallAndMessageChecker : Checker<"CallAndMessage">,
158  HelpText<"Check for logical errors for function calls and Objective-C "
159           "message expressions (e.g., uninitialized arguments, null function "
160           "pointers)">,
161  CheckerOptions<[
162    CmdLineOption<Boolean,
163                  "FunctionPointer",
164                  "Check whether a called function pointer is null or "
165                  "undefined",
166                  "true",
167                  Released>,
168    CmdLineOption<Boolean,
169                  "ParameterCount",
170                  "Check whether a function was called with the appropriate "
171                  "number of arguments",
172                  "true",
173                  Released>,
174    CmdLineOption<Boolean,
175                  "CXXThisMethodCall",
176                  "Check whether the implicit this parameter is null or "
177                  "undefined upon a method call",
178                  "true",
179                  Released>,
180    CmdLineOption<Boolean,
181                  "CXXDeallocationArg",
182                  "Check whether the argument of operator delete is undefined",
183                  "true",
184                  Released>,
185    CmdLineOption<Boolean,
186                  "ArgInitializedness",
187                  "Check whether any of the pass-by-value parameters is "
188                  "undefined",
189                  "true",
190                  Released>,
191    CmdLineOption<Boolean,
192                  "ArgPointeeInitializedness",
193                  "Check whether the pointee of a pass-by-reference or "
194                  "pass-by-pointer is undefined",
195                  "false",
196                  InAlpha>,
197    CmdLineOption<Boolean,
198                  "NilReceiver",
199                  "Check whether the reciever in the message expression is nil",
200                  "true",
201                  Released>,
202    CmdLineOption<Boolean,
203                  "UndefReceiver",
204                  "Check whether the reciever in the message expression is "
205                  "undefined",
206                  "true",
207                  Released>,
208  ]>,
209  Documentation<HasDocumentation>,
210  Dependencies<[CallAndMessageModeling]>;
211
212def DereferenceChecker : Checker<"NullDereference">,
213  HelpText<"Check for dereferences of null pointers">,
214  CheckerOptions<[
215    CmdLineOption<Boolean,
216                  "SuppressAddressSpaces",
217                  "Suppresses warning when pointer dereferences an address space",
218                  "true",
219                  Released>
220  ]>,
221  Documentation<HasDocumentation>;
222
223def NonNullParamChecker : Checker<"NonNullParamChecker">,
224  HelpText<"Check for null pointers passed as arguments to a function whose "
225           "arguments are references or marked with the 'nonnull' attribute">,
226  Documentation<HasDocumentation>;
227
228def VLASizeChecker : Checker<"VLASize">,
229  HelpText<"Check for declarations of VLA of undefined or zero size">,
230  Documentation<HasDocumentation>;
231
232def DivZeroChecker : Checker<"DivideZero">,
233  HelpText<"Check for division by zero">,
234  Documentation<HasDocumentation>;
235
236def UndefResultChecker : Checker<"UndefinedBinaryOperatorResult">,
237  HelpText<"Check for undefined results of binary operators">,
238  Documentation<HasDocumentation>;
239
240def StackAddrEscapeBase : Checker<"StackAddrEscapeBase">,
241  HelpText<"Generate information about stack address escapes.">,
242  Documentation<NotDocumented>,
243  Hidden;
244
245def StackAddrEscapeChecker : Checker<"StackAddressEscape">,
246  HelpText<"Check that addresses to stack memory do not escape the function">,
247  Dependencies<[StackAddrEscapeBase]>,
248  Documentation<HasDocumentation>;
249
250def DynamicTypePropagation : Checker<"DynamicTypePropagation">,
251  HelpText<"Generate dynamic type information">,
252  Documentation<NotDocumented>,
253  Hidden;
254
255def NonnullGlobalConstantsChecker: Checker<"NonnilStringConstants">,
256  HelpText<"Assume that const string-like globals are non-null">,
257  Documentation<NotDocumented>,
258  Hidden;
259
260} // end "core"
261
262let ParentPackage = CoreAlpha in {
263
264def BoolAssignmentChecker : Checker<"BoolAssignment">,
265  HelpText<"Warn about assigning non-{0,1} values to Boolean variables">,
266  Documentation<HasDocumentation>;
267
268def CastSizeChecker : Checker<"CastSize">,
269  HelpText<"Check when casting a malloc'ed type T, whether the size is a "
270           "multiple of the size of T">,
271  Documentation<HasDocumentation>;
272
273def CastToStructChecker : Checker<"CastToStruct">,
274  HelpText<"Check for cast from non-struct pointer to struct pointer">,
275  Documentation<HasDocumentation>;
276
277def ConversionChecker : Checker<"Conversion">,
278  HelpText<"Loss of sign/precision in implicit conversions">,
279  Documentation<HasDocumentation>;
280
281def IdenticalExprChecker : Checker<"IdenticalExpr">,
282  HelpText<"Warn about unintended use of identical expressions in operators">,
283  Documentation<HasDocumentation>;
284
285def FixedAddressChecker : Checker<"FixedAddr">,
286  HelpText<"Check for assignment of a fixed address to a pointer">,
287  Documentation<HasDocumentation>;
288
289def PointerArithChecker : Checker<"PointerArithm">,
290  HelpText<"Check for pointer arithmetic on locations other than array "
291           "elements">,
292  Documentation<HasDocumentation>;
293
294def PointerSubChecker : Checker<"PointerSub">,
295  HelpText<"Check for pointer subtractions on two pointers pointing to "
296           "different memory chunks">,
297  Documentation<HasDocumentation>;
298
299def TestAfterDivZeroChecker : Checker<"TestAfterDivZero">,
300  HelpText<"Check for division by variable that is later compared against 0. "
301           "Either the comparison is useless or there is division by zero.">,
302  Documentation<HasDocumentation>;
303
304def DynamicTypeChecker : Checker<"DynamicTypeChecker">,
305  HelpText<"Check for cases where the dynamic and the static type of an object "
306           "are unrelated.">,
307  Documentation<HasDocumentation>;
308
309def StackAddrAsyncEscapeChecker : Checker<"StackAddressAsyncEscape">,
310  HelpText<"Check that addresses to stack memory do not escape the function">,
311  Dependencies<[StackAddrEscapeBase]>,
312  Documentation<HasDocumentation>;
313
314def PthreadLockBase : Checker<"PthreadLockBase">,
315  HelpText<"Helper registering multiple checks.">,
316  Documentation<NotDocumented>,
317  Hidden;
318
319def C11LockChecker : Checker<"C11Lock">,
320  HelpText<"Simple lock -> unlock checker">,
321  Dependencies<[PthreadLockBase]>,
322  Documentation<HasDocumentation>;
323
324def StdVariantChecker : Checker<"StdVariant">,
325  HelpText<"Check for bad type access for std::variant.">,
326  Documentation<HasDocumentation>;
327
328} // end "alpha.core"
329
330//===----------------------------------------------------------------------===//
331// Nullability checkers.
332//===----------------------------------------------------------------------===//
333
334let ParentPackage = Nullability in {
335
336def NullabilityBase : Checker<"NullabilityBase">,
337  HelpText<"Stores information during the analysis about nullability.">,
338  Documentation<NotDocumented>,
339  Hidden;
340
341def NullPassedToNonnullChecker : Checker<"NullPassedToNonnull">,
342  HelpText<"Warns when a null pointer is passed to a pointer which has a "
343           "_Nonnull type.">,
344  Dependencies<[NullabilityBase]>,
345  Documentation<HasDocumentation>;
346
347def NullReturnedFromNonnullChecker : Checker<"NullReturnedFromNonnull">,
348  HelpText<"Warns when a null pointer is returned from a function that has "
349           "_Nonnull return type.">,
350  Dependencies<[NullabilityBase]>,
351  Documentation<HasDocumentation>;
352
353def NullableDereferencedChecker : Checker<"NullableDereferenced">,
354  HelpText<"Warns when a nullable pointer is dereferenced.">,
355  Dependencies<[NullabilityBase]>,
356  Documentation<HasDocumentation>;
357
358def NullablePassedToNonnullChecker : Checker<"NullablePassedToNonnull">,
359  HelpText<"Warns when a nullable pointer is passed to a pointer which has a "
360           "_Nonnull type.">,
361  Dependencies<[NullabilityBase]>,
362  Documentation<HasDocumentation>;
363
364def NullableReturnedFromNonnullChecker : Checker<"NullableReturnedFromNonnull">,
365  HelpText<"Warns when a nullable pointer is returned from a function that has "
366           "_Nonnull return type.">,
367  Dependencies<[NullabilityBase]>,
368  Documentation<NotDocumented>;
369
370} // end "nullability"
371
372//===----------------------------------------------------------------------===//
373// APIModeling.
374//===----------------------------------------------------------------------===//
375
376let ParentPackage = APIModeling in {
377
378def ErrnoModeling : Checker<"Errno">,
379  HelpText<"Make the special value 'errno' available to other checkers.">,
380  Documentation<NotDocumented>;
381
382def TrustNonnullChecker : Checker<"TrustNonnull">,
383  HelpText<"Trust that returns from framework methods annotated with _Nonnull "
384           "are not null">,
385  Documentation<NotDocumented>;
386
387def TrustReturnsNonnullChecker : Checker<"TrustReturnsNonnull">,
388  HelpText<"Trust that returns from methods annotated with returns_nonnull "
389           "are not null">,
390  Documentation<NotDocumented>;
391
392} // end "apiModeling"
393
394//===----------------------------------------------------------------------===//
395// Evaluate "builtin" functions.
396//===----------------------------------------------------------------------===//
397
398let ParentPackage = CoreBuiltin in {
399
400def NoReturnFunctionChecker : Checker<"NoReturnFunctions">,
401  HelpText<"Evaluate \"panic\" functions that are known to not return to the "
402           "caller">,
403  Documentation<NotDocumented>;
404
405def BuiltinFunctionChecker : Checker<"BuiltinFunctions">,
406  HelpText<"Evaluate compiler builtin functions (e.g., alloca())">,
407  Documentation<NotDocumented>;
408
409} // end "core.builtin"
410
411//===----------------------------------------------------------------------===//
412// Uninitialized values checkers.
413//===----------------------------------------------------------------------===//
414
415let ParentPackage = CoreUninitialized in {
416
417def UndefinedArraySubscriptChecker : Checker<"ArraySubscript">,
418  HelpText<"Check for uninitialized values used as array subscripts">,
419  Documentation<HasDocumentation>;
420
421def UndefinedAssignmentChecker : Checker<"Assign">,
422  HelpText<"Check for assigning uninitialized values">,
423  Documentation<HasDocumentation>;
424
425def UndefBranchChecker : Checker<"Branch">,
426  HelpText<"Check for uninitialized values used as branch conditions">,
427  Documentation<HasDocumentation>;
428
429def UndefCapturedBlockVarChecker : Checker<"CapturedBlockVariable">,
430  HelpText<"Check for blocks that capture uninitialized values">,
431  Documentation<NotDocumented>;
432
433def ReturnUndefChecker : Checker<"UndefReturn">,
434  HelpText<"Check for uninitialized values being returned to the caller">,
435  Documentation<HasDocumentation>;
436
437def UndefinedNewArraySizeChecker : Checker<"NewArraySize">,
438  HelpText<"Check if the size of the array in a new[] expression is undefined">,
439  Documentation<HasDocumentation>;
440
441} // end "core.uninitialized"
442
443//===----------------------------------------------------------------------===//
444// Optin checkers for core language features
445//===----------------------------------------------------------------------===//
446
447let ParentPackage = CoreOptIn in {
448
449def EnumCastOutOfRangeChecker : Checker<"EnumCastOutOfRange">,
450  HelpText<"Check integer to enumeration casts for out of range values">,
451  Documentation<HasDocumentation>;
452
453} // end "optin.core"
454
455//===----------------------------------------------------------------------===//
456// Unix API checkers.
457//===----------------------------------------------------------------------===//
458
459let ParentPackage = CString in {
460
461def CStringModeling : Checker<"CStringModeling">,
462  HelpText<"The base of several CString related checkers. On it's own it emits "
463           "no reports, but adds valuable information to the analysis when "
464           "enabled.">,
465  Documentation<NotDocumented>,
466  Hidden;
467
468def CStringNullArg : Checker<"NullArg">,
469  HelpText<"Check for null pointers being passed as arguments to C string "
470           "functions">,
471  Dependencies<[CStringModeling]>,
472  Documentation<HasDocumentation>;
473
474def CStringSyntaxChecker : Checker<"BadSizeArg">,
475  HelpText<"Check the size argument passed into C string functions for common "
476           "erroneous patterns">,
477  Dependencies<[CStringModeling]>,
478  Documentation<HasDocumentation>;
479
480} // end "unix.cstring"
481
482let ParentPackage = CStringAlpha in {
483
484def CStringOutOfBounds : Checker<"OutOfBounds">,
485  HelpText<"Check for out-of-bounds access in string functions">,
486  Dependencies<[CStringModeling]>,
487  Documentation<HasDocumentation>;
488
489def CStringBufferOverlap : Checker<"BufferOverlap">,
490  HelpText<"Checks for overlap in two buffer arguments">,
491  Dependencies<[CStringModeling]>,
492  Documentation<HasDocumentation>;
493
494def CStringNotNullTerm : Checker<"NotNullTerminated">,
495  HelpText<"Check for arguments which are not null-terminating strings">,
496  Dependencies<[CStringModeling]>,
497  Documentation<HasDocumentation>;
498
499def CStringUninitializedRead : Checker<"UninitializedRead">,
500  HelpText<"Checks if the string manipulation function would read uninitialized bytes">,
501  Dependencies<[CStringModeling]>,
502  Documentation<HasDocumentation>;
503
504} // end "alpha.unix.cstring"
505
506let ParentPackage = Unix in {
507
508def UnixAPIMisuseChecker : Checker<"API">,
509  HelpText<"Check calls to various UNIX/Posix functions">,
510  Documentation<HasDocumentation>;
511
512def BlockInCriticalSectionChecker : Checker<"BlockInCriticalSection">,
513  HelpText<"Check for calls to blocking functions inside a critical section">,
514  Documentation<HasDocumentation>;
515
516def DynamicMemoryModeling: Checker<"DynamicMemoryModeling">,
517  HelpText<"The base of several malloc() related checkers. On it's own it "
518           "emits no reports, but adds valuable information to the analysis "
519           "when enabled.">,
520  CheckerOptions<[
521    CmdLineOption<Boolean,
522                  "Optimistic",
523                  "If set to true, the checker assumes that all the "
524                  "allocating and deallocating functions are annotated with "
525                  "ownership_holds, ownership_takes and ownership_returns.",
526                  "false",
527                  InAlpha>,
528    CmdLineOption<Boolean,
529                  "AddNoOwnershipChangeNotes",
530                  "Add an additional note to the bug report for leak-like "
531                  "bugs. Dynamically allocated objects passed to functions "
532                  "that neither deallocated it, or have taken responsibility "
533                  "of the ownership are noted, similarly to "
534                  "NoStoreFuncVisitor.",
535                  "true",
536                  Released,
537                  Hide>
538  ]>,
539  Dependencies<[CStringModeling]>,
540  Documentation<NotDocumented>,
541  Hidden;
542
543def ErrnoChecker : Checker<"Errno">,
544  HelpText<"Check for improper use of 'errno'">,
545  Dependencies<[ErrnoModeling]>,
546  CheckerOptions<[
547    CmdLineOption<Boolean,
548                  "AllowErrnoReadOutsideConditionExpressions",
549                  "Allow read of undefined value from errno outside of conditions",
550                  "true",
551                  InAlpha>,
552  ]>,
553  Documentation<HasDocumentation>;
554
555def MallocChecker: Checker<"Malloc">,
556  HelpText<"Check for memory leaks, double free, and use-after-free problems. "
557           "Traces memory managed by malloc()/free().">,
558  Dependencies<[DynamicMemoryModeling]>,
559  Documentation<HasDocumentation>;
560
561def MallocSizeofChecker : Checker<"MallocSizeof">,
562  HelpText<"Check for dubious malloc arguments involving sizeof">,
563  Documentation<HasDocumentation>;
564
565def MismatchedDeallocatorChecker : Checker<"MismatchedDeallocator">,
566  HelpText<"Check for mismatched deallocators.">,
567  Dependencies<[DynamicMemoryModeling]>,
568  Documentation<HasDocumentation>;
569
570// This must appear before StdCLibraryFunctionsChecker because a dependency.
571def StreamChecker : Checker<"Stream">,
572  HelpText<"Check stream handling functions">,
573  WeakDependencies<[NonNullParamChecker]>,
574  CheckerOptions<[
575    CmdLineOption<Boolean,
576                  "Pedantic",
577                  "If false, assume that stream operations which are often not "
578                  "checked for error do not fail.",
579                  "false",
580                  InAlpha>
581  ]>,
582  Documentation<HasDocumentation>;
583
584def StdCLibraryFunctionsChecker : Checker<"StdCLibraryFunctions">,
585  HelpText<"Check for invalid arguments of C standard library functions, "
586           "and apply relations between arguments and return value">,
587  CheckerOptions<[
588    CmdLineOption<Boolean,
589                  "DisplayLoadedSummaries",
590                  "If set to true, the checker displays the found summaries "
591                  "for the given translation unit.",
592                  "false",
593                  Released,
594                  Hide>,
595    CmdLineOption<Boolean,
596                  "ModelPOSIX",
597                  "If set to true, the checker models additional functions "
598                  "from the POSIX standard.",
599                  "true",
600                  InAlpha>
601  ]>,
602  WeakDependencies<[CallAndMessageChecker, NonNullParamChecker, StreamChecker]>,
603  Documentation<HasDocumentation>;
604
605def VforkChecker : Checker<"Vfork">,
606  HelpText<"Check for proper usage of vfork">,
607  Documentation<HasDocumentation>;
608
609} // end "unix"
610
611let ParentPackage = UnixAlpha in {
612
613def ChrootChecker : Checker<"Chroot">,
614  HelpText<"Check improper use of chroot">,
615  Documentation<HasDocumentation>;
616
617def PthreadLockChecker : Checker<"PthreadLock">,
618  HelpText<"Simple lock -> unlock checker">,
619  Dependencies<[PthreadLockBase]>,
620  Documentation<HasDocumentation>;
621
622def SimpleStreamChecker : Checker<"SimpleStream">,
623  HelpText<"Check for misuses of stream APIs">,
624  Documentation<HasDocumentation>;
625
626} // end "alpha.unix"
627
628//===----------------------------------------------------------------------===//
629// C++ checkers.
630//===----------------------------------------------------------------------===//
631
632let ParentPackage = Cplusplus in {
633
634def ArrayDeleteChecker : Checker<"ArrayDelete">,
635  HelpText<"Reports destructions of arrays of polymorphic objects that are "
636           "destructed as their base class.">,
637  Documentation<HasDocumentation>;
638
639def InnerPointerChecker : Checker<"InnerPointer">,
640  HelpText<"Check for inner pointers of C++ containers used after "
641           "re/deallocation">,
642  Dependencies<[DynamicMemoryModeling]>,
643  Documentation<NotDocumented>;
644
645def NewDeleteChecker : Checker<"NewDelete">,
646  HelpText<"Check for double-free and use-after-free problems. Traces memory "
647           "managed by new/delete.">,
648  Dependencies<[DynamicMemoryModeling]>,
649  Documentation<HasDocumentation>;
650
651def NewDeleteLeaksChecker : Checker<"NewDeleteLeaks">,
652  HelpText<"Check for memory leaks. Traces memory managed by new/delete.">,
653  Dependencies<[DynamicMemoryModeling]>,
654  Documentation<HasDocumentation>;
655
656def PlacementNewChecker : Checker<"PlacementNew">,
657  HelpText<"Check if default placement new is provided with pointers to "
658           "sufficient storage capacity">,
659  Dependencies<[DynamicMemoryModeling]>,
660  Documentation<HasDocumentation>;
661
662def CXXSelfAssignmentChecker : Checker<"SelfAssignment">,
663  HelpText<"Checks C++ copy and move assignment operators for self assignment">,
664  Documentation<NotDocumented>,
665  Hidden;
666
667def SmartPtrModeling: Checker<"SmartPtrModeling">,
668  HelpText<"Model behavior of C++ smart pointers">,
669  Documentation<NotDocumented>,
670    CheckerOptions<[
671    CmdLineOption<Boolean,
672                  "ModelSmartPtrDereference",
673                  "Enable modeling for SmartPtr null dereferences",
674                  "false",
675                  InAlpha,
676                  Hide>,
677  ]>,
678  Hidden;
679
680def StringChecker: Checker<"StringChecker">,
681  HelpText<"Checks C++ std::string bugs">,
682  Documentation<HasDocumentation>;
683
684def MoveChecker: Checker<"Move">,
685  HelpText<"Find use-after-move bugs in C++">,
686  CheckerOptions<[
687    CmdLineOption<String,
688                  "WarnOn",
689                  "With setting \"KnownsOnly\" warn only on objects with known "
690                  "move semantics like smart pointers and other STL objects. "
691                  "With setting \"KnownsAndLocals\" warn additionally on local "
692                  "variables (or rvalue references). With setting \"All\" warn "
693                  "on all variables (excluding global variables).",
694                  "KnownsAndLocals",
695                  Released>
696  ]>,
697  Documentation<HasDocumentation>;
698
699def VirtualCallModeling : Checker<"VirtualCallModeling">,
700  HelpText<"Auxiliary modeling for the virtual method call checkers">,
701  Documentation<NotDocumented>,
702  Hidden;
703
704def PureVirtualCallChecker : Checker<"PureVirtualCall">,
705  HelpText<"Check pure virtual function calls during construction/destruction">,
706  Dependencies<[VirtualCallModeling]>,
707  Documentation<HasDocumentation>;
708} // end: "cplusplus"
709
710let ParentPackage = CplusplusOptIn in {
711
712def UninitializedObjectChecker: Checker<"UninitializedObject">,
713  HelpText<"Reports uninitialized fields after object construction">,
714  CheckerOptions<[
715    CmdLineOption<Boolean,
716                  "Pedantic",
717                  "If set to false, the checker won't emit warnings "
718                  "for objects that don't have at least one initialized "
719                  "field.",
720                  "false",
721                  Released>,
722    CmdLineOption<Boolean,
723                  "NotesAsWarnings",
724                  "If set to true, the checker will emit a warning "
725                  "for each uninitalized field, as opposed to emitting one "
726                  "warning per constructor call, and listing the uninitialized "
727                  "fields that belongs to it in notes.",
728                  "false",
729                  Released,
730                  Hide>,
731    CmdLineOption<Boolean,
732                  "CheckPointeeInitialization",
733                  "If set to false, the checker will not analyze "
734                  "the pointee of pointer/reference fields, and will only "
735                  "check whether the object itself is initialized.",
736                  "false",
737                  InAlpha>,
738    CmdLineOption<String,
739                  "IgnoreRecordsWithField",
740                  "If supplied, the checker will not analyze "
741                  "structures that have a field with a name or type name that "
742                  "matches the given pattern.",
743                  "\"\"",
744                  Released>,
745    CmdLineOption<Boolean,
746                  "IgnoreGuardedFields",
747                  "If set to true, the checker will analyze _syntactically_ "
748                  "whether the found uninitialized object is used without a "
749                  "preceding assert call. Defaults to false.",
750                  "false",
751                  InAlpha>
752  ]>,
753  Documentation<HasDocumentation>;
754
755def VirtualCallChecker : Checker<"VirtualCall">,
756  HelpText<"Check virtual function calls during construction/destruction">,
757  CheckerOptions<[
758    CmdLineOption<Boolean,
759                  "ShowFixIts",
760                  "Enable fix-it hints for this checker",
761                  "false",
762                  InAlpha>,
763    CmdLineOption<Boolean,
764                  "PureOnly",
765                  "Disables the checker. Keeps cplusplus.PureVirtualCall "
766                  "enabled. This option is only provided for backwards "
767                  "compatibility.",
768                  "false",
769                  InAlpha>
770  ]>,
771  Dependencies<[VirtualCallModeling]>,
772  Documentation<HasDocumentation>;
773
774} // end: "optin.cplusplus"
775
776let ParentPackage = CplusplusAlpha in {
777
778def ContainerModeling : Checker<"ContainerModeling">,
779  HelpText<"Models C++ containers">,
780  Documentation<NotDocumented>,
781  Hidden;
782
783def DeleteWithNonVirtualDtorChecker : Checker<"DeleteWithNonVirtualDtor">,
784  HelpText<"Reports destructions of polymorphic objects with a non-virtual "
785           "destructor in their base class">,
786  Documentation<HasDocumentation>;
787
788def IteratorModeling : Checker<"IteratorModeling">,
789  HelpText<"Models iterators of C++ containers">,
790  Dependencies<[ContainerModeling]>,
791  Documentation<NotDocumented>,
792  Hidden;
793
794def STLAlgorithmModeling : Checker<"STLAlgorithmModeling">,
795  HelpText<"Models the algorithm library of the C++ STL.">,
796  CheckerOptions<[
797    CmdLineOption<Boolean,
798                  "AggressiveStdFindModeling",
799                  "Enables exploration of the failure branch in std::find-like "
800                  "functions.",
801                  "false",
802                  Released>
803  ]>,
804  Dependencies<[ContainerModeling]>,
805  Documentation<NotDocumented>;
806
807def InvalidatedIteratorChecker : Checker<"InvalidatedIterator">,
808  HelpText<"Check for use of invalidated iterators">,
809  Dependencies<[IteratorModeling]>,
810  Documentation<HasDocumentation>;
811
812def IteratorRangeChecker : Checker<"IteratorRange">,
813  HelpText<"Check for iterators used outside their valid ranges">,
814  Dependencies<[IteratorModeling]>,
815  Documentation<HasDocumentation>;
816
817def MismatchedIteratorChecker : Checker<"MismatchedIterator">,
818  HelpText<"Check for use of iterators of different containers where iterators "
819           "of the same container are expected">,
820  Dependencies<[IteratorModeling]>,
821  Documentation<HasDocumentation>;
822
823def SmartPtrChecker: Checker<"SmartPtr">,
824  HelpText<"Find the dereference of null SmrtPtr">,
825  Dependencies<[SmartPtrModeling]>,
826  Documentation<HasDocumentation>;
827
828} // end: "alpha.cplusplus"
829
830
831//===----------------------------------------------------------------------===//
832// Valist checkers.
833//===----------------------------------------------------------------------===//
834
835let ParentPackage = Valist in {
836
837def ValistBase : Checker<"ValistBase">,
838  HelpText<"Gathers information about va_lists.">,
839  Documentation<NotDocumented>,
840  Hidden;
841
842def UninitializedChecker : Checker<"Uninitialized">,
843  HelpText<"Check for usages of uninitialized (or already released) va_lists.">,
844  Dependencies<[ValistBase]>,
845  Documentation<NotDocumented>;
846
847def UnterminatedChecker : Checker<"Unterminated">,
848  HelpText<"Check for va_lists which are not released by a va_end call.">,
849  Dependencies<[ValistBase]>,
850  Documentation<NotDocumented>;
851
852def CopyToSelfChecker : Checker<"CopyToSelf">,
853  HelpText<"Check for va_lists which are copied onto itself.">,
854  Dependencies<[ValistBase]>,
855  Documentation<NotDocumented>;
856
857} // end : "valist"
858
859//===----------------------------------------------------------------------===//
860// Deadcode checkers.
861//===----------------------------------------------------------------------===//
862
863let ParentPackage = DeadCode in {
864
865def DeadStoresChecker : Checker<"DeadStores">,
866  HelpText<"Check for values stored to variables that are never read "
867           "afterwards">,
868  CheckerOptions<[
869    CmdLineOption<Boolean,
870                  "WarnForDeadNestedAssignments",
871                  "Warns for deadstores in nested assignments."
872                  "E.g.: if ((P = f())) where P is unused.",
873                  "true",
874                  Released>,
875    CmdLineOption<Boolean,
876                  "ShowFixIts",
877                  "Enable fix-it hints for this checker",
878                  "false",
879                  InAlpha>
880  ]>,
881  Documentation<HasDocumentation>;
882
883} // end DeadCode
884
885let ParentPackage = DeadCodeAlpha in {
886
887def UnreachableCodeChecker : Checker<"UnreachableCode">,
888  HelpText<"Check unreachable code">,
889  Documentation<HasDocumentation>;
890
891} // end "alpha.deadcode"
892
893//===----------------------------------------------------------------------===//
894// Performance checkers.
895//===----------------------------------------------------------------------===//
896
897let ParentPackage = Performance in {
898
899def PaddingChecker : Checker<"Padding">,
900  HelpText<"Check for excessively padded structs.">,
901  CheckerOptions<[
902    CmdLineOption<Integer,
903                  "AllowedPad",
904                  "Reports are only generated if the excessive padding exceeds "
905                  "'AllowedPad' in bytes.",
906                  "24",
907                  Released>
908  ]>,
909  Documentation<HasDocumentation>;
910
911} // end: "padding"
912
913//===----------------------------------------------------------------------===//
914// Security checkers.
915//===----------------------------------------------------------------------===//
916
917let ParentPackage = InsecureAPI in {
918
919def SecuritySyntaxChecker : Checker<"SecuritySyntaxChecker">,
920  HelpText<"Base of various security function related checkers">,
921  Documentation<NotDocumented>,
922  Hidden;
923
924def bcmp : Checker<"bcmp">,
925  HelpText<"Warn on uses of the 'bcmp' function">,
926  Dependencies<[SecuritySyntaxChecker]>,
927  Documentation<HasDocumentation>;
928
929def bcopy : Checker<"bcopy">,
930  HelpText<"Warn on uses of the 'bcopy' function">,
931  Dependencies<[SecuritySyntaxChecker]>,
932  Documentation<HasDocumentation>;
933
934def bzero : Checker<"bzero">,
935  HelpText<"Warn on uses of the 'bzero' function">,
936  Dependencies<[SecuritySyntaxChecker]>,
937  Documentation<HasDocumentation>;
938
939def gets : Checker<"gets">,
940  HelpText<"Warn on uses of the 'gets' function">,
941  Dependencies<[SecuritySyntaxChecker]>,
942  Documentation<HasDocumentation>;
943
944def getpw : Checker<"getpw">,
945  HelpText<"Warn on uses of the 'getpw' function">,
946  Dependencies<[SecuritySyntaxChecker]>,
947  Documentation<HasDocumentation>;
948
949def mktemp : Checker<"mktemp">,
950  HelpText<"Warn on uses of the 'mktemp' function">,
951  Dependencies<[SecuritySyntaxChecker]>,
952  Documentation<HasDocumentation>;
953
954def mkstemp : Checker<"mkstemp">,
955  HelpText<"Warn when 'mkstemp' is passed fewer than 6 X's in the format "
956           "string">,
957  Dependencies<[SecuritySyntaxChecker]>,
958  Documentation<HasDocumentation>;
959
960def rand : Checker<"rand">,
961  HelpText<"Warn on uses of the 'rand', 'random', and related functions">,
962  Dependencies<[SecuritySyntaxChecker]>,
963  Documentation<HasDocumentation>;
964
965def strcpy : Checker<"strcpy">,
966  HelpText<"Warn on uses of the 'strcpy' and 'strcat' functions">,
967  Dependencies<[SecuritySyntaxChecker]>,
968  Documentation<HasDocumentation>;
969
970def vfork : Checker<"vfork">,
971  HelpText<"Warn on uses of the 'vfork' function">,
972  Dependencies<[SecuritySyntaxChecker]>,
973  Documentation<HasDocumentation>;
974
975def UncheckedReturn : Checker<"UncheckedReturn">,
976  HelpText<"Warn on uses of functions whose return values must be always "
977           "checked">,
978  Dependencies<[SecuritySyntaxChecker]>,
979  Documentation<HasDocumentation>;
980
981def DeprecatedOrUnsafeBufferHandling :
982  Checker<"DeprecatedOrUnsafeBufferHandling">,
983  HelpText<"Warn on uses of unsecure or deprecated buffer manipulating "
984           "functions">,
985  Dependencies<[SecuritySyntaxChecker]>,
986  Documentation<HasDocumentation>;
987
988def decodeValueOfObjCType : Checker<"decodeValueOfObjCType">,
989  HelpText<"Warn on uses of the '-decodeValueOfObjCType:at:' method">,
990  Dependencies<[SecuritySyntaxChecker]>,
991  Documentation<HasDocumentation>;
992
993} // end "security.insecureAPI"
994
995let ParentPackage = Security in {
996
997def FloatLoopCounter : Checker<"FloatLoopCounter">,
998  HelpText<"Warn on using a floating point value as a loop counter (CERT: "
999           "FLP30-C, FLP30-CPP)">,
1000  Dependencies<[SecuritySyntaxChecker]>,
1001  Documentation<HasDocumentation>;
1002
1003def PutenvStackArray : Checker<"PutenvStackArray">,
1004  HelpText<"Finds calls to the function 'putenv' which pass a pointer to "
1005           "an automatic (stack-allocated) array as the argument.">,
1006  Documentation<HasDocumentation>;
1007
1008def SetgidSetuidOrderChecker : Checker<"SetgidSetuidOrder">,
1009  HelpText<"Warn on possible reversed order of 'setgid(getgid()))' and "
1010           "'setuid(getuid())' (CERT: POS36-C)">,
1011  Documentation<HasDocumentation>;
1012
1013} // end "security"
1014
1015let ParentPackage = ENV in {
1016
1017  def InvalidPtrChecker : Checker<"InvalidPtr">,
1018  HelpText<"Finds usages of possibly invalidated pointers">,
1019  CheckerOptions<[
1020    CmdLineOption<Boolean,
1021                  "InvalidatingGetEnv",
1022                  "Regard getenv as an invalidating call (as per POSIX "
1023                  "standard), which can lead to false positives depending on "
1024                  "implementation.",
1025                  "false",
1026                  Released>,
1027  ]>,
1028  Documentation<HasDocumentation>;
1029
1030} // end "security.cert.env"
1031
1032let ParentPackage = SecurityAlpha in {
1033
1034def ArrayBoundChecker : Checker<"ArrayBound">,
1035  HelpText<"Warn about buffer overflows (older checker)">,
1036  Documentation<HasDocumentation>;
1037
1038def ArrayBoundCheckerV2 : Checker<"ArrayBoundV2">,
1039  HelpText<"Warn about buffer overflows (newer checker)">,
1040  Documentation<HasDocumentation>;
1041
1042def MallocOverflowSecurityChecker : Checker<"MallocOverflow">,
1043  HelpText<"Check for overflows in the arguments to malloc()">,
1044  Documentation<HasDocumentation>;
1045
1046def MmapWriteExecChecker : Checker<"MmapWriteExec">,
1047  HelpText<"Warn on mmap() calls that are both writable and executable">,
1048  CheckerOptions<[
1049    CmdLineOption<Integer,
1050                  "MmapProtExec",
1051                  "Specifies the value of PROT_EXEC",
1052                  "0x04",
1053                  Released>,
1054    CmdLineOption<Integer,
1055                  "MmapProtRead",
1056                  "Specifies the value of PROT_READ",
1057                  "0x01",
1058                  Released>
1059  ]>,
1060  Documentation<HasDocumentation>;
1061
1062def ReturnPointerRangeChecker : Checker<"ReturnPtrRange">,
1063  HelpText<"Check for an out-of-bound pointer being returned to callers">,
1064  Documentation<HasDocumentation>;
1065
1066} // end "alpha.security"
1067
1068//===----------------------------------------------------------------------===//
1069// Taint checkers.
1070//===----------------------------------------------------------------------===//
1071
1072let ParentPackage = Taint in {
1073
1074def TaintPropagationChecker : Checker<"TaintPropagation">, // Modelling checker
1075  HelpText<"Generate taint information used by other checkers">,
1076  CheckerOptions<[
1077    CmdLineOption<String,
1078                  "Config",
1079                  "Specifies the name of the configuration file.",
1080                  "",
1081                  InAlpha>,
1082  ]>,
1083  Documentation<NotDocumented>,
1084  Hidden;
1085
1086def GenericTaintChecker : Checker<"GenericTaint">,
1087  HelpText<"Reports potential injection vulnerabilities">,
1088  Dependencies<[TaintPropagationChecker]>,
1089  Documentation<HasDocumentation>;
1090
1091} // end "alpha.security.taint"
1092
1093//===----------------------------------------------------------------------===//
1094// Mac OS X, Cocoa, and Core Foundation checkers.
1095//===----------------------------------------------------------------------===//
1096
1097let ParentPackage = Cocoa in {
1098
1099def RetainCountBase : Checker<"RetainCountBase">,
1100  HelpText<"Common base of various retain count related checkers">,
1101  Documentation<NotDocumented>,
1102  Hidden;
1103
1104} // end "osx.cocoa"
1105
1106let ParentPackage = OSX in {
1107
1108def NSOrCFErrorDerefChecker : Checker<"NSOrCFErrorDerefChecker">,
1109  HelpText<"Implementation checker for NSErrorChecker and CFErrorChecker">,
1110  Documentation<NotDocumented>,
1111  Hidden;
1112
1113def NumberObjectConversionChecker : Checker<"NumberObjectConversion">,
1114  HelpText<"Check for erroneous conversions of objects representing numbers "
1115           "into numbers">,
1116  CheckerOptions<[
1117    CmdLineOption<Boolean,
1118                  "Pedantic",
1119                  "Enables detection of more conversion patterns (which are "
1120                  "most likely more harmless, and therefore are more likely to "
1121                  "produce false positives).",
1122                  "false",
1123                  Released>
1124  ]>,
1125  Documentation<NotDocumented>;
1126
1127def MacOSXAPIChecker : Checker<"API">,
1128  HelpText<"Check for proper uses of various Apple APIs">,
1129  Documentation<HasDocumentation>;
1130
1131def MacOSKeychainAPIChecker : Checker<"SecKeychainAPI">,
1132  HelpText<"Check for proper uses of Secure Keychain APIs">,
1133  Documentation<HasDocumentation>;
1134
1135def MIGChecker : Checker<"MIG">,
1136  HelpText<"Find violations of the Mach Interface Generator "
1137           "calling convention">,
1138  Documentation<NotDocumented>;
1139
1140def ObjCPropertyChecker : Checker<"ObjCProperty">,
1141  HelpText<"Check for proper uses of Objective-C properties">,
1142  Documentation<NotDocumented>;
1143
1144def OSObjectRetainCountChecker : Checker<"OSObjectRetainCount">,
1145  HelpText<"Check for leaks and improper reference count management for "
1146           "OSObject">,
1147  Dependencies<[RetainCountBase]>,
1148  Documentation<NotDocumented>;
1149
1150} // end "osx"
1151
1152let ParentPackage = Cocoa in {
1153
1154def RunLoopAutoreleaseLeakChecker : Checker<"RunLoopAutoreleaseLeak">,
1155  HelpText<"Check for leaked memory in autorelease pools that will never be "
1156           "drained">,
1157  Documentation<NotDocumented>;
1158
1159def ObjCAtSyncChecker : Checker<"AtSync">,
1160  HelpText<"Check for nil pointers used as mutexes for @synchronized">,
1161  Documentation<HasDocumentation>;
1162
1163def NilArgChecker : Checker<"NilArg">,
1164  HelpText<"Check for prohibited nil arguments to ObjC method calls">,
1165  Documentation<HasDocumentation>;
1166
1167def ClassReleaseChecker : Checker<"ClassRelease">,
1168  HelpText<"Check for sending 'retain', 'release', or 'autorelease' directly "
1169           "to a Class">,
1170  Documentation<HasDocumentation>;
1171
1172def VariadicMethodTypeChecker : Checker<"VariadicMethodTypes">,
1173  HelpText<"Check for passing non-Objective-C types to variadic collection "
1174           "initialization methods that expect only Objective-C types">,
1175  Documentation<HasDocumentation>;
1176
1177def NSAutoreleasePoolChecker : Checker<"NSAutoreleasePool">,
1178  HelpText<"Warn for suboptimal uses of NSAutoreleasePool in Objective-C GC "
1179           "mode">,
1180  Documentation<HasDocumentation>;
1181
1182def ObjCMethSigsChecker : Checker<"IncompatibleMethodTypes">,
1183  HelpText<"Warn about Objective-C method signatures with type "
1184           "incompatibilities">,
1185  Documentation<HasDocumentation>;
1186
1187def ObjCUnusedIvarsChecker : Checker<"UnusedIvars">,
1188  HelpText<"Warn about private ivars that are never used">,
1189  Documentation<HasDocumentation>;
1190
1191def ObjCSelfInitChecker : Checker<"SelfInit">,
1192  HelpText<"Check that 'self' is properly initialized inside an initializer "
1193           "method">,
1194  Documentation<HasDocumentation>;
1195
1196def ObjCLoopChecker : Checker<"Loops">,
1197  HelpText<"Improved modeling of loops using Cocoa collection types">,
1198  Documentation<NotDocumented>;
1199
1200def ObjCNonNilReturnValueChecker : Checker<"NonNilReturnValue">,
1201  HelpText<"Model the APIs that are guaranteed to return a non-nil value">,
1202  Documentation<NotDocumented>;
1203
1204def ObjCSuperCallChecker : Checker<"MissingSuperCall">,
1205  HelpText<"Warn about Objective-C methods that lack a necessary call to "
1206           "super">,
1207  Documentation<NotDocumented>;
1208
1209def NSErrorChecker : Checker<"NSError">,
1210  HelpText<"Check usage of NSError** parameters">,
1211  Dependencies<[NSOrCFErrorDerefChecker]>,
1212  Documentation<HasDocumentation>;
1213
1214def RetainCountChecker : Checker<"RetainCount">,
1215  HelpText<"Check for leaks and improper reference count management">,
1216  CheckerOptions<[
1217    CmdLineOption<Boolean,
1218                  "TrackNSCFStartParam",
1219                  "Check not only that the code follows retain-release rules "
1220                  "with respect to objects it allocates or borrows from "
1221                  "elsewhere, but also that it fulfills its own retain count "
1222                  "specification with respect to objects that it receives as "
1223                  "arguments.",
1224                  "false",
1225                  Released>
1226  ]>,
1227  Dependencies<[RetainCountBase]>,
1228  Documentation<HasDocumentation>;
1229
1230def ObjCGenericsChecker : Checker<"ObjCGenerics">,
1231  HelpText<"Check for type errors when using Objective-C generics">,
1232  Dependencies<[DynamicTypePropagation]>,
1233  Documentation<HasDocumentation>;
1234
1235def ObjCDeallocChecker : Checker<"Dealloc">,
1236  HelpText<"Warn about Objective-C classes that lack a correct implementation "
1237           "of -dealloc">,
1238  Documentation<HasDocumentation>;
1239
1240def ObjCSuperDeallocChecker : Checker<"SuperDealloc">,
1241  HelpText<"Warn about improper use of '[super dealloc]' in Objective-C">,
1242  Documentation<HasDocumentation>;
1243
1244def AutoreleaseWriteChecker : Checker<"AutoreleaseWrite">,
1245  HelpText<"Warn about potentially crashing writes to autoreleasing objects "
1246           "from different autoreleasing pools in Objective-C">,
1247  Documentation<NotDocumented>;
1248
1249} // end "osx.cocoa"
1250
1251let ParentPackage = Performance in {
1252
1253def GCDAntipattern : Checker<"GCDAntipattern">,
1254  HelpText<"Check for performance anti-patterns when using Grand Central "
1255           "Dispatch">,
1256  Documentation<NotDocumented>;
1257} // end "optin.performance"
1258
1259let ParentPackage = OSXOptIn in {
1260
1261def OSObjectCStyleCast : Checker<"OSObjectCStyleCast">,
1262  HelpText<"Checker for C-style casts of OSObjects">,
1263  Documentation<NotDocumented>;
1264
1265} // end "optin.osx"
1266
1267let ParentPackage = CocoaAlpha in {
1268
1269def IvarInvalidationModeling : Checker<"IvarInvalidationModeling">,
1270  HelpText<"Gathers information for annotation driven invalidation checking "
1271           "for classes that contains a method annotated with "
1272           "'objc_instance_variable_invalidator'">,
1273  Documentation<NotDocumented>,
1274  Hidden;
1275
1276def InstanceVariableInvalidation : Checker<"InstanceVariableInvalidation">,
1277  HelpText<"Check that the invalidatable instance variables are invalidated in "
1278           "the methods annotated with objc_instance_variable_invalidator">,
1279  Dependencies<[IvarInvalidationModeling]>,
1280  Documentation<HasDocumentation>;
1281
1282def MissingInvalidationMethod : Checker<"MissingInvalidationMethod">,
1283  HelpText<"Check that the invalidation methods are present in classes that "
1284           "contain invalidatable instance variables">,
1285  Dependencies<[IvarInvalidationModeling]>,
1286  Documentation<HasDocumentation>;
1287
1288def DirectIvarAssignment : Checker<"DirectIvarAssignment">,
1289  HelpText<"Check for direct assignments to instance variables">,
1290  CheckerOptions<[
1291    CmdLineOption<Boolean,
1292                  "AnnotatedFunctions",
1293                  "Check for direct assignments to instance variables in the "
1294                  "methods annotated with "
1295                  "objc_no_direct_instance_variable_assignment",
1296                  "false",
1297                  InAlpha>
1298  ]>,
1299  Documentation<HasDocumentation>;
1300
1301} // end "alpha.osx.cocoa"
1302
1303let ParentPackage = CoreFoundation in {
1304
1305def CFNumberChecker : Checker<"CFNumber">,
1306  HelpText<"Check for proper uses of CFNumber APIs">,
1307  Documentation<HasDocumentation>;
1308
1309def CFRetainReleaseChecker : Checker<"CFRetainRelease">,
1310  HelpText<"Check for null arguments to CFRetain/CFRelease/CFMakeCollectable">,
1311  Documentation<HasDocumentation>;
1312
1313def CFErrorChecker : Checker<"CFError">,
1314  HelpText<"Check usage of CFErrorRef* parameters">,
1315  Dependencies<[NSOrCFErrorDerefChecker]>,
1316  Documentation<HasDocumentation>;
1317
1318} // end "osx.coreFoundation"
1319
1320let ParentPackage = Containers in {
1321
1322def ObjCContainersASTChecker : Checker<"PointerSizedValues">,
1323  HelpText<"Warns if 'CFArray', 'CFDictionary', 'CFSet' are created with "
1324           "non-pointer-size values">,
1325  Documentation<HasDocumentation>;
1326
1327def ObjCContainersChecker : Checker<"OutOfBounds">,
1328  HelpText<"Checks for index out-of-bounds when using 'CFArray' API">,
1329  Documentation<HasDocumentation>;
1330
1331} // end "osx.coreFoundation.containers"
1332
1333let ParentPackage = LocalizabilityOptIn in {
1334
1335def NonLocalizedStringChecker : Checker<"NonLocalizedStringChecker">,
1336  HelpText<"Warns about uses of non-localized NSStrings passed to UI methods "
1337           "expecting localized NSStrings">,
1338  CheckerOptions<[
1339    CmdLineOption<Boolean,
1340                  "AggressiveReport",
1341                  "Marks a string being returned by any call as localized if "
1342                  "it is in LocStringFunctions (LSF) or the function is "
1343                  "annotated. Otherwise, we mark it as NonLocalized "
1344                  "(Aggressive) or NonLocalized only if it is not backed by a "
1345                  "SymRegion (Non-Aggressive), basically leaving only string "
1346                  "literals as NonLocalized.",
1347                  "false",
1348                  InAlpha,
1349                  Hide>
1350  ]>,
1351  Documentation<HasDocumentation>;
1352
1353def EmptyLocalizationContextChecker :
1354  Checker<"EmptyLocalizationContextChecker">,
1355  HelpText<"Check that NSLocalizedString macros include a comment for context">,
1356  Documentation<HasDocumentation>;
1357
1358} // end "optin.osx.cocoa.localizability"
1359
1360let ParentPackage = LocalizabilityAlpha in {
1361
1362def PluralMisuseChecker : Checker<"PluralMisuseChecker">,
1363  HelpText<"Warns against using one vs. many plural pattern in code when "
1364           "generating localized strings.">,
1365  Documentation<HasDocumentation>;
1366
1367} // end "alpha.osx.cocoa.localizability"
1368
1369let ParentPackage = MPI in {
1370
1371def MPIChecker : Checker<"MPI-Checker">,
1372  HelpText<"Checks MPI code">,
1373  Documentation<HasDocumentation>;
1374
1375} // end "optin.mpi"
1376
1377//===----------------------------------------------------------------------===//
1378// Checkers for LLVM development.
1379//===----------------------------------------------------------------------===//
1380
1381let ParentPackage = LLVMAlpha in {
1382
1383def LLVMConventionsChecker : Checker<"Conventions">,
1384  HelpText<"Check code for LLVM codebase conventions">,
1385  Documentation<HasDocumentation>;
1386
1387} // end "llvm"
1388
1389let ParentPackage = LLVMAPIModeling in {
1390
1391def CastValueChecker : Checker<"CastValue">,
1392  HelpText<"Model implementation of custom RTTIs">,
1393  Documentation<NotDocumented>;
1394
1395def ReturnValueChecker : Checker<"ReturnValue">,
1396  HelpText<"Model certain Error() methods that always return true by convention">,
1397  Documentation<NotDocumented>;
1398
1399} // end "apiModeling.llvm"
1400
1401//===----------------------------------------------------------------------===//
1402// Checkers modeling Google APIs.
1403//===----------------------------------------------------------------------===//
1404
1405let ParentPackage = GoogleAPIModeling in {
1406
1407def GTestChecker : Checker<"GTest">,
1408  HelpText<"Model gtest assertion APIs">,
1409  Documentation<NotDocumented>;
1410
1411} // end "apiModeling.google"
1412
1413//===----------------------------------------------------------------------===//
1414// Debugging checkers (for analyzer development).
1415//===----------------------------------------------------------------------===//
1416
1417let ParentPackage = Debug in {
1418
1419def AnalysisOrderChecker : Checker<"AnalysisOrder">,
1420  HelpText<"Print callbacks that are called during analysis in order">,
1421  CheckerOptions<[
1422    CmdLineOption<Boolean,
1423                  "PreStmtCastExpr",
1424                  "",
1425                  "false",
1426                  Released,
1427                  Hide>,
1428    CmdLineOption<Boolean,
1429                  "PostStmtCastExpr",
1430                  "",
1431                  "false",
1432                  Released,
1433                  Hide>,
1434    CmdLineOption<Boolean,
1435                  "PreStmtArraySubscriptExpr",
1436                  "",
1437                  "false",
1438                  Released,
1439                  Hide>,
1440    CmdLineOption<Boolean,
1441                  "PostStmtArraySubscriptExpr",
1442                  "",
1443                  "false",
1444                  Released,
1445                  Hide>,
1446    CmdLineOption<Boolean,
1447                  "PreStmtCXXNewExpr",
1448                  "",
1449                  "false",
1450                  Released,
1451                  Hide>,
1452    CmdLineOption<Boolean,
1453                  "PostStmtCXXNewExpr",
1454                  "",
1455                  "false",
1456                  Released,
1457                  Hide>,
1458    CmdLineOption<Boolean,
1459                  "PreStmtCXXDeleteExpr",
1460                  "",
1461                  "false",
1462                  Released,
1463                  Hide>,
1464    CmdLineOption<Boolean,
1465                  "PostStmtCXXDeleteExpr",
1466                  "",
1467                  "false",
1468                  Released,
1469                  Hide>,
1470    CmdLineOption<Boolean,
1471                  "PreStmtCXXConstructExpr",
1472                  "",
1473                  "false",
1474                  Released,
1475                  Hide>,
1476    CmdLineOption<Boolean,
1477                  "PostStmtCXXConstructExpr",
1478                  "",
1479                  "false",
1480                  Released,
1481                  Hide>,
1482    CmdLineOption<Boolean,
1483                  "PreStmtOffsetOfExpr",
1484                  "",
1485                  "false",
1486                  Released,
1487                  Hide>,
1488    CmdLineOption<Boolean,
1489                  "PostStmtOffsetOfExpr",
1490                  "",
1491                  "false",
1492                  Released,
1493                  Hide>,
1494    CmdLineOption<Boolean,
1495                  "EvalCall",
1496                  "",
1497                  "false",
1498                  Released,
1499                  Hide>,
1500    CmdLineOption<Boolean,
1501                  "PreCall",
1502                  "",
1503                  "false",
1504                  Released,
1505                  Hide>,
1506    CmdLineOption<Boolean,
1507                  "PostCall",
1508                  "",
1509                  "false",
1510                  Released,
1511                  Hide>,
1512    CmdLineOption<Boolean,
1513                  "EndFunction",
1514                  "",
1515                  "false",
1516                  Released,
1517                  Hide>,
1518    CmdLineOption<Boolean,
1519                  "EndAnalysis",
1520                  "",
1521                  "false",
1522                  Released,
1523                  Hide>,
1524    CmdLineOption<Boolean,
1525                  "NewAllocator",
1526                  "",
1527                  "false",
1528                  Released,
1529                  Hide>,
1530    CmdLineOption<Boolean,
1531                  "Bind",
1532                  "",
1533                  "false",
1534                  Released,
1535                  Hide>,
1536    CmdLineOption<Boolean,
1537                  "LiveSymbols",
1538                  "",
1539                  "false",
1540                  Released,
1541                  Hide>,
1542    CmdLineOption<Boolean,
1543                  "RegionChanges",
1544                  "",
1545                  "false",
1546                  Released,
1547                  Hide>,
1548    CmdLineOption<Boolean,
1549                  "PointerEscape",
1550                  "",
1551                  "false",
1552                  Released,
1553                  Hide>,
1554    CmdLineOption<Boolean,
1555                  "*",
1556                  "Enables all callbacks.",
1557                  "false",
1558                  Released,
1559                  Hide>
1560  ]>,
1561  Documentation<NotDocumented>;
1562
1563def DominatorsTreeDumper : Checker<"DumpDominators">,
1564  HelpText<"Print the dominance tree for a given CFG">,
1565  Documentation<NotDocumented>;
1566
1567def PostDominatorsTreeDumper : Checker<"DumpPostDominators">,
1568  HelpText<"Print the post dominance tree for a given CFG">,
1569  Documentation<NotDocumented>;
1570
1571def ControlDependencyTreeDumper : Checker<"DumpControlDependencies">,
1572  HelpText<"Print the post control dependency tree for a given CFG">,
1573  Documentation<NotDocumented>;
1574
1575def LiveVariablesDumper : Checker<"DumpLiveVars">,
1576  HelpText<"Print results of live variable analysis">,
1577  Documentation<NotDocumented>;
1578
1579def LiveExpressionsDumper : Checker<"DumpLiveExprs">,
1580  HelpText<"Print results of live expression analysis">,
1581  Documentation<NotDocumented>;
1582
1583def CFGViewer : Checker<"ViewCFG">,
1584  HelpText<"View Control-Flow Graphs using GraphViz">,
1585  Documentation<NotDocumented>;
1586
1587def CFGDumper : Checker<"DumpCFG">,
1588  HelpText<"Display Control-Flow Graphs">,
1589  Documentation<NotDocumented>;
1590
1591def CallGraphViewer : Checker<"ViewCallGraph">,
1592  HelpText<"View Call Graph using GraphViz">,
1593  Documentation<NotDocumented>;
1594
1595def CallGraphDumper : Checker<"DumpCallGraph">,
1596  HelpText<"Display Call Graph">,
1597  Documentation<NotDocumented>;
1598
1599def ConfigDumper : Checker<"ConfigDumper">,
1600  HelpText<"Dump config table">,
1601  Documentation<NotDocumented>;
1602
1603def TraversalDumper : Checker<"DumpTraversal">,
1604  HelpText<"Print branch conditions as they are traversed by the engine">,
1605  Documentation<NotDocumented>;
1606
1607def CallDumper : Checker<"DumpCalls">,
1608  HelpText<"Print calls as they are traversed by the engine">,
1609  Documentation<NotDocumented>;
1610
1611def AnalyzerStatsChecker : Checker<"Stats">,
1612  HelpText<"Emit warnings with analyzer statistics">,
1613  Documentation<NotDocumented>;
1614
1615def TaintTesterChecker : Checker<"TaintTest">,
1616  HelpText<"Mark tainted symbols as such.">,
1617  Documentation<NotDocumented>;
1618
1619// This checker *technically* depends on SteamChecker, but we don't allow
1620// dependency checkers to emit diagnostics, and a debug checker isn't worth
1621// the chore needed to create a modeling portion on its own. Since this checker
1622// is for development purposes only anyways, make sure that StreamChecker is
1623// also enabled, at least for the time being.
1624def StreamTesterChecker : Checker<"StreamTester">,
1625  HelpText<"Add test functions to StreamChecker for test and debugging "
1626           "purposes.">,
1627  WeakDependencies<[StreamChecker]>,
1628  Documentation<NotDocumented>;
1629
1630def ErrnoTesterChecker : Checker<"ErrnoTest">,
1631  HelpText<"Check modeling aspects of 'errno'.">,
1632  Dependencies<[ErrnoModeling]>,
1633  Documentation<NotDocumented>;
1634
1635def ExprInspectionChecker : Checker<"ExprInspection">,
1636  HelpText<"Check the analyzer's understanding of expressions">,
1637  Documentation<NotDocumented>;
1638
1639def ExplodedGraphViewer : Checker<"ViewExplodedGraph">,
1640  HelpText<"View Exploded Graphs using GraphViz">,
1641  Documentation<NotDocumented>;
1642
1643def ReportStmts : Checker<"ReportStmts">,
1644  HelpText<"Emits a warning for every statement.">,
1645  Documentation<NotDocumented>;
1646
1647def DebugContainerModeling : Checker<"DebugContainerModeling">,
1648  HelpText<"Check the analyzer's understanding of C++ containers">,
1649  Dependencies<[ContainerModeling]>,
1650  Documentation<NotDocumented>;
1651
1652def DebugIteratorModeling : Checker<"DebugIteratorModeling">,
1653  HelpText<"Check the analyzer's understanding of C++ iterators">,
1654  Dependencies<[DebugContainerModeling, IteratorModeling]>,
1655  Documentation<NotDocumented>;
1656
1657def StdCLibraryFunctionsTesterChecker : Checker<"StdCLibraryFunctionsTester">,
1658  HelpText<"Add test functions to the summary map, so testing of individual "
1659           "summary constituents becomes possible.">,
1660  WeakDependencies<[StdCLibraryFunctionsChecker]>,
1661  Documentation<NotDocumented>;
1662
1663def CheckerDocumentationChecker : Checker<"CheckerDocumentation">,
1664  HelpText<"Defines an empty checker callback for all possible handlers.">,
1665  Documentation<NotDocumented>;
1666
1667} // end "debug"
1668
1669
1670//===----------------------------------------------------------------------===//
1671// Clone Detection
1672//===----------------------------------------------------------------------===//
1673
1674let ParentPackage = CloneDetectionAlpha in {
1675
1676def CloneChecker : Checker<"CloneChecker">,
1677  HelpText<"Reports similar pieces of code.">,
1678  CheckerOptions<[
1679    CmdLineOption<Integer,
1680                  "MinimumCloneComplexity",
1681                  "Ensures that every clone has at least the given complexity. "
1682                  "Complexity is here defined as the total amount of children "
1683                  "of a statement. This constraint assumes the first statement "
1684                  "in the group is representative for all other statements in "
1685                  "the group in terms of complexity.",
1686                  "50",
1687                  Released>,
1688    CmdLineOption<Boolean,
1689                  "ReportNormalClones",
1690                  "Report all clones, even less suspicious ones.",
1691                  "true",
1692                  Released>,
1693    CmdLineOption<String,
1694                  "IgnoredFilesPattern",
1695                  "If supplied, the checker wont analyze files with a filename "
1696                  "that matches the given pattern.",
1697                  "\"\"",
1698                  Released>
1699  ]>,
1700  Documentation<HasDocumentation>;
1701
1702} // end "clone"
1703
1704//===----------------------------------------------------------------------===//
1705// Portability checkers.
1706//===----------------------------------------------------------------------===//
1707
1708let ParentPackage = PortabilityOptIn in {
1709
1710def UnixAPIPortabilityChecker : Checker<"UnixAPI">,
1711  HelpText<"Finds implementation-defined behavior in UNIX/Posix functions">,
1712  Documentation<NotDocumented>;
1713
1714} // end optin.portability
1715
1716
1717//===----------------------------------------------------------------------===//
1718// Taint checkers.
1719//===----------------------------------------------------------------------===//
1720
1721let ParentPackage = TaintOptIn in {
1722
1723def TaintedAllocChecker: Checker<"TaintedAlloc">,
1724  HelpText<"Check for memory allocations, where the size parameter "
1725           "might be a tainted (attacker controlled) value.">,
1726  Dependencies<[DynamicMemoryModeling, TaintPropagationChecker]>,
1727  Documentation<HasDocumentation>;
1728
1729} // end "optin.taint"
1730
1731//===----------------------------------------------------------------------===//
1732// NonDeterminism checkers.
1733//===----------------------------------------------------------------------===//
1734
1735let ParentPackage = NonDeterminismAlpha in {
1736
1737def PointerIterationChecker : Checker<"PointerIteration">,
1738  HelpText<"Checks for non-determinism caused by iteration of unordered containers of pointers">,
1739  Documentation<HasDocumentation>;
1740
1741def PointerSortingChecker : Checker<"PointerSorting">,
1742  HelpText<"Check for non-determinism caused by sorting of pointers">,
1743  Documentation<HasDocumentation>;
1744
1745} // end alpha.nondeterminism
1746
1747//===----------------------------------------------------------------------===//
1748// Fuchsia checkers.
1749//===----------------------------------------------------------------------===//
1750
1751let ParentPackage = Fuchsia in {
1752
1753def FuchsiaHandleChecker : Checker<"HandleChecker">,
1754  HelpText<"A Checker that detect leaks related to Fuchsia handles">,
1755  Documentation<HasDocumentation>;
1756
1757}
1758
1759let ParentPackage = FuchsiaAlpha in {
1760
1761def FuchsiaLockChecker : Checker<"Lock">,
1762  HelpText<"Check for the correct usage of locking APIs.">,
1763  Dependencies<[PthreadLockBase]>,
1764  Documentation<HasDocumentation>;
1765
1766} // end fuchsia
1767
1768//===----------------------------------------------------------------------===//
1769// WebKit checkers.
1770//===----------------------------------------------------------------------===//
1771
1772let ParentPackage = WebKit in {
1773
1774def RefCntblBaseVirtualDtorChecker : Checker<"RefCntblBaseVirtualDtor">,
1775  HelpText<"Check for any ref-countable base class having virtual destructor.">,
1776  Documentation<HasDocumentation>;
1777
1778def NoUncountedMemberChecker : Checker<"NoUncountedMemberChecker">,
1779  HelpText<"Check for no uncounted member variables.">,
1780  Documentation<HasDocumentation>;
1781
1782def UncountedLambdaCapturesChecker : Checker<"UncountedLambdaCapturesChecker">,
1783  HelpText<"Check uncounted lambda captures.">,
1784  Documentation<HasDocumentation>;
1785
1786} // end webkit
1787
1788let ParentPackage = WebKitAlpha in {
1789
1790def UncountedCallArgsChecker : Checker<"UncountedCallArgsChecker">,
1791  HelpText<"Check uncounted call arguments.">,
1792  Documentation<HasDocumentation>;
1793
1794def UncountedLocalVarsChecker : Checker<"UncountedLocalVarsChecker">,
1795  HelpText<"Check uncounted local variables.">,
1796  Documentation<HasDocumentation>;
1797
1798} // end alpha.webkit
1799