Commit Graph

314 Commits

Author SHA1 Message Date
Georgy Komarov 38a055d2f3
ExprEngine: Better debug output for exceptions (#2943) 2020-12-13 16:54:22 +01:00
Daniel Marjamäki 8f71e62fd6 Fix Cppcheck warning 2020-12-13 16:47:50 +01:00
Georgy Komarov 36ab23f1f7
ExprEngine: Handle pointers to struct as function argument (#2945) 2020-12-13 16:02:35 +01:00
Daniel Marjamäki 81c3ac738d CI: Fix testrunner 2020-12-13 15:51:20 +01:00
Daniel Marjamäki 6fb1a81eae Bug hunting; more debug output 2020-12-13 14:05:35 +01:00
Daniel Marjamäki b18dc0fdbb Bug hunting: Handle not better 2020-12-13 13:00:04 +01:00
Daniel Marjamäki 0ccc5c695b Bug hunting: prevent recursion in analysis when code calls self 2020-12-13 09:33:40 +01:00
Daniel Marjamäki be16b2c276 Bug hunting; better handling of early return 2020-12-13 09:13:26 +01:00
Daniel Marjamäki 2e96cc932d ExprEngine; Improved debug output, show constraints. 2020-12-12 21:23:38 +01:00
Daniel Marjamäki a7fb946ab8 ExprEngine: Clarify debug output a bit 2020-12-12 18:29:17 +01:00
Daniel Marjamäki cba8b99095 ExprEngine: Catch and handle exceptions in ExprData 2020-12-12 17:33:21 +01:00
Daniel Marjamäki d0f700305c ExprEngine: Avoid analyzing unreachable execution paths 2020-12-12 15:22:49 +01:00
Daniel Marjamäki 6d7ddde1b5 Bug hunting; Make bughuntingUninit check a bit less noisy about const parameters 2020-12-08 13:34:46 +01:00
Daniel Marjamäki 02bb14003b Bug hunting; better handling of struct member assignment in for loop 2020-12-07 19:58:19 +01:00
Daniel Marjamäki 39a9350f6e Bug hunting: Better analysis of BailoutValue 2020-12-07 06:27:14 +01:00
Daniel Marjamäki 7e9cbda2d5 Revert "2"
This reverts commit db386b2a7f.

That commit was half-done and not intended to be merged.
2020-12-06 22:29:46 +01:00
Daniel Marjamäki db386b2a7f 2 2020-12-06 21:45:48 +01:00
Daniel Marjamäki d12732adfb Bug hunting; Diagnose array index out of bounds when struct member is accessed 2020-12-06 17:44:07 +01:00
Daniel Marjamäki 3bf758a04b Bug hunting; Ensure there is warning after unknown variable expression 2020-12-06 10:13:10 +01:00
Daniel Marjamäki 7324722dab Bug hunting; Detect array index out of bounds in loop better 2020-12-05 20:39:54 +01:00
Daniel Marjamäki 86ceafa870 Fixed compiler warning; missing enum case in switch 2020-12-05 13:02:43 +01:00
Daniel Marjamäki da4cd6a4f4 Bug hunting; Improved buffer overflow check 2020-12-05 11:47:57 +01:00
Daniel Marjamäki 65721dd7a9 Bug hunting; Better handling of constant 2020-10-08 17:24:35 +02:00
Daniel Marjamäki b052843655 exprengine: Use and tweak ExprEngine::ArrayValue::MAXSIZE 2020-10-04 11:21:13 +02:00
Daniel Marjamäki d60520137c ExprEngine: Refactoring 2020-09-10 08:02:15 +02:00
Daniel Marjamäki 7c8c0ef3a2 Bug hunting: Avoid uninit struct member false positives 2020-09-09 18:26:04 +02:00
Daniel Marjamäki b0b31feadd fix ubsan errors 2020-09-05 21:09:11 +02:00
Daniel Marjamäki 6277eece67 Variable contracts 2020-08-24 20:57:49 +02:00
Georgy Komarov c5369b84e1
Prevent copying in range-based for loops (#2751)
Use reference types in range for loops to prevent copying.
2020-08-23 20:53:44 +02:00
Daniel Marjamäki 4a76dbb632 Bug hunting; Avoid bailout uninit FP, stream object 2020-07-19 16:54:44 +02:00
Daniel Marjamäki e9281babc4 Bug hunting; avoid false positives for structs/classes with constructors 2020-07-18 18:54:21 +02:00
Daniel Marjamäki 8d6fd4769b Bug hunting; Terminating analysis 2020-07-14 11:22:42 +02:00
Daniel Marjamäki fe324aea49 Bug hunting; Detect internal error and throw exception 2020-07-14 10:25:00 +02:00
Daniel Marjamäki f34ff9325a Fixed testrunner 2020-06-29 21:53:14 +02:00
Daniel Marjamäki a0770f05e1 Reuse 'extractForLoopValues' in ValueFlow 2020-06-29 21:01:43 +02:00
Daniel Marjamäki b5cd96cbda ExprEngine; Rename variable 2020-06-28 21:36:56 +02:00
Daniel Marjamäki ad5e4fef1f Bug hunting; improved handling of 'malloc' in uninit checker 2020-06-28 21:20:59 +02:00
Daniel Marjamäki 0e736e0c29 Rename BugHuntingException to ExprEngineException 2020-06-28 17:39:14 +02:00
Daniel Marjamäki d4bd3016da ExprEngine; Improved handling of for loop, loop variable 2020-06-28 17:28:40 +02:00
Daniel Marjamäki c42c751d61 ExprEngine; Fixed testing 2020-06-28 13:41:27 +02:00
Daniel Marjamäki f85cdd3f77 ExprEngine: DataIndex update to get better debug output 2020-06-28 10:52:50 +02:00
Daniel Marjamäki bcaf792e30 Bug hunting; Fix FP for struct with uninitialized members passed to function in C 2020-06-27 22:11:12 +02:00
Daniel Marjamäki c7a8f5217f ExprEngine; Fixed Cppcheck warning 2020-06-27 21:54:38 +02:00
Daniel Marjamäki cd49eb0978 Fix Cppcheck warnings 2020-06-27 20:59:10 +02:00
Daniel Marjamäki d353a4ecba ExprEngine; copy Data => copy arrays 2020-06-27 18:09:43 +02:00
Daniel Marjamäki ff5a717fc6 Bug hunting; Avoid false positives for const parameter data 2020-06-27 12:17:11 +02:00
Daniel Marjamäki ab14d2bc0f exceptRethrowCopy: Fixed FP in Cppcheck 2020-06-22 12:26:41 +02:00
Daniel Marjamäki f792cabc2b ExprEngine; better handling of containers 2020-06-21 21:48:36 +02:00
Daniel Marjamäki 5497e8ed67 ExprEngine; Improved handling of stream read 2020-06-21 20:05:26 +02:00
Daniel Marjamäki 11e2b5ea14 Bug hunting; Timeout 2020-06-21 18:28:07 +02:00
Daniel Marjamäki 65498b5e9a Bug hunting; Fixed hang when there is recursion 2020-06-21 15:16:05 +02:00
Daniel Marjamäki ff445f9ca2 Bug hunting; Make cve.py happy again 2020-06-21 08:50:27 +02:00
Daniel Marjamäki f270ca1909 ExprEngine; Better handling of function calls 2020-06-20 23:00:39 +02:00
Daniel Marjamäki af45148e58 ExprEngine; Refactor and improve code. Add tests for increments. 2020-06-19 20:40:20 +02:00
Daniel Marjamäki 06aeac75dc Bug hunting; Fix false negatives 2020-06-19 18:38:02 +02:00
Daniel Marjamäki b4443aa5a0 Suppress exceptRethrowCopy false positive 2020-06-19 18:15:04 +02:00
Daniel Marjamäki 8653c4b3a9 ExprEngine; Fix uninitialized value FP in subfunction when argument is passed by value 2020-06-19 18:05:56 +02:00
Daniel Marjamäki 6ec15b6d7b ExprEngine; Simple handling of increment/decrement 2020-06-19 17:35:35 +02:00
Daniel Marjamäki a5a3738df4 Fixed cve.py 2020-06-19 17:13:35 +02:00
orbitcowboy f60e805798 Running astyle [ci skip] 2020-06-19 16:36:09 +02:00
Daniel Marjamäki c62e345340 Fix Cppcheck warning 2020-06-19 14:11:49 +02:00
Daniel Marjamäki f516bde744 ExprEngine; Fix TODO assertion 2020-06-19 14:05:19 +02:00
Daniel Marjamäki d0ac583b97 Add 'bughuntingchecks' 2020-06-19 13:16:48 +02:00
Daniel Marjamäki cbe038e694 ExprEngine: execute functions in same TU 2020-06-19 10:27:59 +02:00
Daniel Marjamäki 542158d0f4 Bug hunting; checking uninitialized struct member 2020-06-18 13:49:11 +02:00
Daniel Marjamäki d26593321d Fixed Visual Studio compile error 2020-06-16 22:56:01 +02:00
Daniel Marjamäki 4947a3b7ab Bug hunting; review and improve handling of multi dimensional arrays 2020-06-16 22:50:45 +02:00
Daniel Marjamäki 6faad9cd90 Bug hunting; better handling when assigning multidimensional array in for loop 2020-06-15 22:42:45 +02:00
Daniel Marjamäki b36c85d8fd Rename VerifyException to BugHuntingException 2020-06-15 22:07:32 +02:00
Daniel Marjamäki 27fc5f1a2f Fix Cppcheck warning 2020-05-27 21:31:40 +02:00
Daniel Marjamäki f482eb49cd ExprEngine; Fixed bug. Constraint expressions must be boolean 2020-05-27 19:37:07 +02:00
Daniel Marjamäki 5a4b309e6f Bug hunting: Add 'buffer overflow' check. Detect CVE-2019-19334 2020-05-23 17:50:24 +02:00
Daniel Marjamäki 820a9c29c1 ExprEngine: Return instead of Throw to continue analysis more 2020-05-23 11:43:30 +02:00
Daniel Marjamäki e5a3dc1a0c ExprEngine; Slow processing 2020-05-23 11:31:12 +02:00
Daniel Marjamäki 4e2f8d5d48 astyle formatting
[ci skip]
2020-05-23 07:30:22 +02:00
Oliver Stöneberg 37bc0483a4
made check.h less heavy (#2633) 2020-05-23 07:16:49 +02:00
Daniel Marjamäki 871cf379d5 ExprData: Better handling of ternary operator 2020-05-15 21:34:52 +02:00
Daniel Marjamäki 76f4fae806 Bug hunting; Started to activate some itc tests for uninitialized variables 2020-05-15 20:58:33 +02:00
Daniel Marjamäki e508950f4f ExprEngine; Activate bug hunting analysis for uninitialized variables/data. This analysis is pretty experimental right now. 2020-05-15 11:25:56 +02:00
Daniel Marjamäki 0799d74071 Tweak Z3 version checks 2020-05-12 17:01:16 +02:00
Daniel Marjamäki 3e650c311b Remove NEW_Z3 macro 2020-05-12 16:57:07 +02:00
Daniel Marjamäki 046f8eb6c6 ExprEngine: improved handling when lhs/rhs for && has unknown value 2020-05-10 22:50:23 +02:00
Oliver Stöneberg e0e50139cb
cleaned up includes based on include-what-you-use (#2632)
* cleaned up includes based on include-what-you-use

* token.cpp: fixed -Wextra-semi-stmt warning
2020-05-10 16:45:45 +02:00
Daniel Marjamäki 08ddd84780 Update copyright year 2020-05-10 11:16:32 +02:00
Daniel Marjamäki 3e0218299b Revert "Update copyright year"
This reverts commit 6eec6c4bd5.
2020-05-10 11:13:05 +02:00
Daniel Marjamäki 6eec6c4bd5 Update copyright year 2020-05-10 11:11:34 +02:00
Daniel Marjamäki d4169f04d5 Bug hunting; Avoid false warnings for impossible values 2020-05-08 17:42:56 +02:00
Daniel Marjamäki 02d88cb191 Travis: Run TestExprEngine tests 2020-05-08 12:21:22 +02:00
Daniel Marjamäki b5094f298a Bug hunting; Add new 'incomplete' flag for error messages. Used when analysis is incomplete. 2020-05-03 17:20:38 +02:00
Daniel Marjamäki 4c63940902 Add bug hunting test case for CVE-2019-7156 2020-05-02 22:22:31 +02:00
Daniel Marjamäki 56abbc1d42 Fixed segmentation faults 2020-05-01 18:10:18 +02:00
Daniel Marjamäki 34572a40ab Bug hunting: Fixed handling of switch 'case %char%' 2020-05-01 15:15:24 +02:00
Daniel Marjamäki 999ef06156 ExprEngine: Try to handle function with unknown type better 2020-04-30 22:10:30 +02:00
Daniel Marjamäki b27fabaacb Refactoring ExprEngine 2020-04-30 21:49:27 +02:00
Daniel Marjamäki b97250e0fa ExprEngine; Try to handle assignments better 2020-04-30 21:05:34 +02:00
Daniel Marjamäki 5a9e81897a ExprEngine: Document how it works 2020-04-30 12:18:49 +02:00
Daniel Marjamäki e30eabc896 ExprEngine: Fail to execute contract => write error message 2020-04-29 18:30:12 +02:00
Daniel Marjamäki daea5e2d6c Bug hunting: Do not warn about 'Division by zero' when variable is uninitialized 2020-04-29 11:00:33 +02:00
Daniel Marjamäki 5d67fd0e56 Bug hunting: Set 'inconclusive' flag for bailout values 2020-04-29 10:58:01 +02:00
Daniel Marjamäki 3eb19a64cb Removed inline suppression, it was not a FP, use #ifdef differently 2020-04-28 22:29:16 +02:00