Commit Graph

706 Commits

Author SHA1 Message Date
Paul Fultz II ef714225bb Use library to track container lifetimes 2019-08-15 21:14:54 +02:00
Daniel Marjamäki a57d22d2d9 astyle formatting
[ci skip]
2019-08-15 10:46:16 +02:00
Paul Fultz II af214e8212 Fix issue 8825: ValueFlow: uninitialized struct member (#2087)
* Pass uninit value across pointers

* Add more testing
2019-08-15 10:44:55 +02:00
Paul Fultz II 0c1dff5c93 Fix issue 9268: false negative: (style) Condition '...' is always true (#2080)
* Fix issue 9268: false negative: (style) Condition '...' is always true

* Fix copy and paste mistake
2019-08-14 06:34:27 +02:00
Paul Fultz II 13df5b2413 Fix FP with negative index and negated condition (#2081) 2019-08-14 06:32:31 +02:00
Paul Fultz II c0c6f92221 Fix issue 8431 and 8776: Size of constant string
Fixes these cases:

```cpp
void f(void) {
        const std::string msg="xyz";
        if(!msg.empty()){} // Always true
}
```

And out of bounds access:

```cpp
#include <string>
char fstr1(){const std::string s = "<a><b>"; return s[42]; }
wchar_t fwstr1(){const std::wstring s = L"<a><b>"; return s[42]; }
```
2019-08-12 20:24:16 +02:00
Paul Fultz II 68e8253920 Fix issue 8313 and 7326: Track values of pointer aliases in valueflow 2019-08-12 12:58:53 +02:00
Paul Fultz II 9aa97cbb95 Fix issue 8296: ValueFlow: value not set in conditional scope in subfunction (#2071)
* Fix issue 8296: ValueFlow: value not set in conditional scope in subfunction

* Refactor condition checkingg

* Make test case TODO
2019-08-11 15:39:37 +02:00
Paul Fultz II bd02ca5ccb Fix issue 9207: Not detected 'always true' and unreachable code 2019-08-08 07:46:47 +02:00
Paul Fultz II aaeec462e6 Re-enable valueFlowSubFunction (#2063)
* Re-enable valueFlowSubFunction

* Formatting

* Skip ternary operators in subfunctions

* Fix test with iostreams

* Fix FP with multiple parameters
2019-08-05 16:26:32 +02:00
Paul Fultz II ffdd2dc793 Fix issue 8924: Re-enable valueFlowTerminatingCondition 2019-08-05 07:18:06 +02:00
Daniel Marjamäki ce53931d00 Fixed #9251 (False positive: unininitialized variable (multi variables)) 2019-08-03 21:12:34 +02:00
amai2012 f02636e995 Refactoring: Convert enums to enum classes 2019-08-02 21:14:29 +02:00
Daniel Marjamäki e8ec6e6f11 Fixed #8349 (Noisy nullPointerRedundantCheck) 2019-07-27 20:03:06 +02:00
Paul Fultz II b049fd9303 Improve propogation of lifetimes of function arguments
This will now warn for cases like this:

```cpp
int* f(int * x) {
    return x;
}
int * g(int x) {
    return f(&x);
}
````
2019-07-26 07:02:07 +02:00
Daniel Marjamäki 45d1ca6f7c Safe checks: Clarify a warning message 2019-07-25 17:19:51 +02:00
Daniel Marjamäki fb7f18ddea ValueFlow: fix false detection of duplicate values 2019-07-24 12:30:33 +02:00
Daniel Marjamäki cab9f61b79 safe checks: Handle float parameters 2019-07-24 12:09:13 +02:00
Daniel Marjamäki e0738c48d2 simplify code 2019-07-24 11:40:51 +02:00
Daniel Marjamäki 10be2a1941 Safe checks: container parameters 2019-07-24 11:39:35 +02:00
Paul Fultz II 3ec3bd52e0 Fix FP when using a pointer to a container (#2029) 2019-07-24 00:04:49 +02:00
Paul Fultz II ab0fcc7640 Fix issue 9216: reset() method confusion (#2025)
* Fix issue 9216 with smart pointer reset

* Check for arrow
2019-07-23 22:45:58 +02:00
Paul Fultz II 60b670babd Fix issue 9219: False positive, returnDanglingLifetime (#2026)
* Check for pointer deref for container methods

* Formatting
2019-07-23 21:59:05 +02:00
Paul Fultz II a08a9c1349 Switch to use lifetime analysis for iterators and pointers to invalid containers
This will diagnose more issues such as:

```cpp
void f(std::vector<int> &v) {
    auto v0 = v.begin();
    v.push_back(123);
    std::cout << *v0 << std::endl;
}
```
2019-07-18 10:56:44 +02:00
Daniel Marjamäki f0aeb845e5 ValueFlow: Clarify warnings when argument min/max values are used 2019-07-17 22:17:34 +02:00
Daniel Marjamäki b4a05a3dd0 Refactoring: Use enum class 2019-07-16 11:12:35 +02:00
Daniel Marjamäki 32eda27391 Refactoring: Use enum class 2019-07-16 10:51:26 +02:00
Daniel Marjamäki 38182bf37b Replace 'unsigned' with 'nonneg' in valueflow 2019-07-15 13:47:17 +02:00
Daniel Marjamäki 68cc7516a1 Annotations: Add annotation __cppcheck_in_range__(low,high) 2019-07-12 11:09:54 +02:00
Daniel Marjamäki 783f7f1648 Rename safeValues to unknownValues 2019-07-11 16:05:48 +02:00
Daniel Marjamäki a9d61c4ddd Fix Cppcheck warning 2019-07-10 22:08:27 +02:00
Daniel Marjamäki 5f217021ab Another attempt to fix appveyor 2019-07-10 21:30:50 +02:00
Daniel Marjamäki 45844ef962 Try to fix appveyor. Replace int64_t with MathLib::bigint. 2019-07-10 21:26:20 +02:00
Daniel Marjamäki 05d35b063d Function return: Extra check of safe function return values 2019-07-10 20:00:21 +02:00
Daniel Marjamäki c9906125de Safe functions: Check more possible function argument values 2019-07-10 16:59:05 +02:00
Daniel Marjamäki 9f548efbd3 Refactoring: enum class 2019-07-10 15:27:07 +02:00
Paul Fultz II b0d10273ed Fix issue 3695: Handle class pointers
This switches to use lifetime analysis to check for assigning to non-local variables:

```cpp
class test
{
public:

  void f()
  {
    int x;
    this->ptr = &x;
  }

protected:
  int *ptr;
};
```
2019-07-07 10:16:19 +02:00
Rikard Falkeborn 839fcddd8a Fix #6115 (Add support to realloc to cfg files) (#1953)
* Allow to configure realloc like functions

* memleakonrealloc: Bring back tests.

The old memleak checker was removed, and the tests for it was removed in
commit 9765a2dfab. This also removed the
tests for memleakOnRealloc. Bring back those tests, somewhat modified
since the checker no longer checks for memory leaks.

* Add realloc to mem leak check

* Add tests of realloc buffer size

* Configure realloc functions

* Add test of freopen

* Allow to configure which element is realloc argument

* Fix wrong close in test

cppcheck now warns for this

* Update manual

* Update docs

* Rename alloc/dalloc/realloc functions

Naming the member function realloc caused problems on appveyor. Rename
the alloc and dealloc functions as well for consistency.

* Change comparisson order

* Remove variable and use function call directly

* Create temporary variable to simplify

* Throw mismatchError on mismatching allocation/reallocation

* Refactor to separate function

* Fix potential nullptr dereference

As pointed out by cppcheck.
2019-07-05 12:44:52 +02:00
shaneasd 7e54f989f9 Update symbol database such that the override keyword implies that the function is also virtual (#1907)
* Update symbol database such that the override keyword implies that the function is also virtual

* Add test case for implicit override

* change isVirtual to hasVirtualSpecifier

* fix method documentation for getVirtualFunctionCalls and getFirstVirtualFunctionCallStack

* Fix isImplicitlyVirtual to consider the override keyword and document logic

* Fix getFirstVirtualFunctionCallStack and getVirtualFunctionCalls to use isImplicitlyVirtual instead of isVirtual so new test case passes
2019-07-04 12:32:32 +02:00
Scott Furry a195477470 Correct Zero/Null as pointer constant (#1938)
Building with enhanced clang warnings indicated a large number of
instances with the warning:

`warning: zero as null pointer constant`

Recommended practice in C++11 is to use `nullptr` as value for
a NULL or empty pointer value. All instances where this warning
was encountered were corrected in this commit.

Where warning was encountered in dependency code (i.e. external library)
no chnages were made. Patching will be offered upstream.
2019-06-30 21:39:22 +02:00
Daniel Marjamäki 56df6169fb Fixed #8356 (ValueFlow: variable is not changed in for loop) 2019-06-30 17:50:35 +02:00
Rikard Falkeborn d1d622b74c Valueflow: support global static const variables (#1861) 2019-06-29 14:33:55 +02:00
Paul Fultz II 66e0f06494 Fixx issue 9163: FP returnDanglingLifetime - returning std::string::find (#1912)
* Fixx issue 9163: FP returnDanglingLifetime - returning std::string::find

* Use simpleMatch
2019-06-24 18:52:17 +02:00
Rikard Falkeborn d909ac8565 Bugfix buffer size for strdup like functions (#1893)
strdup() allocates the string length plus one for a terminating null
character. Add one to compensate for this.

Fixes false positive buffer out of bounds on code like this:

	void f() {
		const char *a = "abcd";
		char * b = strdup(a);
		printf("%c", b[4]); // prints the terminating null character
		free(b);
	}

Also, add a testcase for valueFlowDynamicBufferSize() and add tests for
strdup(), malloc() and calloc().
2019-06-16 16:02:27 +02:00
Ken-Patrick 66ebc187f6 Cleanup some const_cast of Token* (#1886)
* Add non const version of some methods of Token

The aim is to reduce the (ab)use of const_cast.

* Cleanup some more const_cast in valueflow

* Remove useless const_cast

* Remove some const_cast from templatesimplifier

* Remove some const_cast from valueflow
2019-06-16 10:09:38 +02:00
Paul Fultz II 6ae7be0f53 Fix FP with lifetime containers (#1865) 2019-06-02 10:14:48 +02:00
Paul Fultz II f75c15af56 Fix issue 6821: New check: access heap/stack data using address of variable
This fixes errors with:

```cpp
int f() {
    int i;
    return (&i)[1];
}
```

It uses the lifetime analysis to detect the issues.
2019-05-31 12:24:31 +02:00
Paul Fultz II 108cdaa485 Fix FP with unreadVariable (#1859) 2019-05-31 08:06:36 +02:00
orbitcowboy 55df395a4e Running astyle [ci skip] 2019-05-30 14:41:14 +02:00
Ken-Patrick 3cdc236e10 Fix false positive with several ! (not) operators (#1856)
With the following code
  int f(int x, int y) {
      if (!!(x != 0)) {
        return y/x;
  }

cppcheck would wrongly warn that there might be a division by zero in
"return y/x;".
2019-05-29 09:45:15 +02:00
Carlo Marcelo Arenas Belón bf5c71bdca sync (#1835)
* build: remove -Wabi and add -Wundef

gcc >= 8 throws a warning about -Wabi (without a specific ABI version)
being ignored, while -Wundef seems more useful (as shown by the change
in config.h, which was probably an unfortunate typo)

travis.yaml should probably be updated soon, but was left out from this
change as the current images don't yet need it

* lib: unused function in valueflow

refactored out since 8c03be3212

lib/valueflow.cpp:3124:21: warning: unused function 'endTemplateArgument' [-Wunused-function]

* readme: include picojson

* make: also clean exe
2019-05-17 09:31:41 +02:00
Paul Fultz II 4e94c64da8 Fix issue 9099 and 9102: Incorrect valueflow for global variables (#1832) 2019-05-14 08:58:27 +02:00
Paul Fultz II 8c03be3212 Fix issue 9077: False positive: Returning pointer to local variable (#1821)
* Avoid implicit conversion for lifetimes

* Fix issue 9077

* Add more tests

* Rename function

* Fix implicit conversion with containers

* Format

* Fix crash
2019-05-05 11:40:59 +02:00
Paul Fultz II a688df0ea1 Fix issue 9120: crash in valueflow (#1822) 2019-05-05 09:51:36 +02:00
Daniel Marjamäki 0b3342abe5 Fix Cppcheck warning 2019-05-04 20:41:43 +02:00
Paul Fultz II 091f4bcf8d Add check for unnecessary search before insertion
This will warn for cases where searching in an associative container happens before insertion, like this:

```cpp
void f1(std::set<unsigned>& s, unsigned x) {
    if (s.find(x) == s.end()) {
        s.insert(x);
    }
}

void f2(std::map<unsigned, unsigned>& m, unsigned x) {
    if (m.find(x) == m.end()) {
        m.emplace(x, 1);
    } else {
        m[x] = 1;
    }
}
```

In the case of the map it could be written as `m[x] = 1` as it will create the key if it doesnt exist, so the extra search is not necessary.

I have this marked as `performance` as it is mostly concerning performance, but there could be a copy-paste error possibly, although I dont think thats common.
2019-05-02 11:04:23 +02:00
Daniel Marjamäki 6c3c090403 Fixed #6317 (wrong simplification: int i = 1.5; return i; get simplified to: return 1.5;) 2019-05-01 17:05:16 +02:00
Rikard Falkeborn 1cc5f3abe7 Set wchar_t type (#1807)
This is necessary for valueflow to know the size, for example when
calculating sizeof(wchar_t).
2019-05-01 16:34:28 +02:00
Paul Fultz II 71bd7f68d4 Fix bug in lifetime constructors (#1816) 2019-05-01 07:52:52 +02:00
Daniel Marjamäki 66064fb2bb Disable valueFlowGlobalConstVar until #9099 is fixed 2019-04-30 20:51:59 +02:00
Daniel Marjamäki b1ca7c9a66 astyle formatting
[ci skip]
2019-04-26 11:30:35 +02:00
Paul Fultz II 39f4374446 Improve diagnostics with null smart pointers (#1805)
* Warn when dereferencing null smart pointers

* Improve tracking of smart pointer values

* Use library isSmartPointer
2019-04-26 11:30:09 +02:00
Gary Leutheuser bca2dfb3f4 Implement #7597 - valueflow: global constant (#1802)
* Implement const global value flow

* Tabs to spaces
2019-04-21 06:54:32 +02:00
Rikard Falkeborn d23e987941 Fix CheckInternal warnings (#1790) 2019-04-06 06:55:46 +02:00
Daniel Marjamäki 55433fce40 Library: added bufferSize parameters 2019-03-20 19:26:57 +01:00
Daniel Marjamäki 14528bcf25 Library: allowed values for the buffer-size attribute: malloc/calloc/strdup 2019-03-20 06:46:55 +01:00
Paul Fultz II 774464eabb Fix issue 8996: False positive duplicateCondition
This fixes issue 8996 by improving the alias checking by using lifetime analysis. It also extends the lifetime checker to handle constructors and initializer lists for containers and arrays.
2019-03-19 06:25:10 +01:00
Daniel Marjamäki 3c85d8a8ac ValueFlow: Better info for buffer size values 2019-03-17 19:02:36 +01:00
Daniel Marjamäki 92f4113b59 Array index: Checking array index out of bounds for dynamic buffers 2019-03-17 13:09:15 +01:00
Daniel Marjamäki b984897526 ValueFlow: Fix sizeof for array of library type 2019-03-13 18:31:41 +01:00
Daniel Marjamäki 11e32ff445 ValueFlow: Handle compound assignments in execute() 2019-03-12 18:53:58 +01:00
Daniel Marjamäki 7b17b33a49 ValueFlow: fix handling of sizeof(*p) 2019-03-11 20:32:24 +01:00
Daniel Marjamäki 5563fef7bb Fixed #9008 (new crash in clang test suite) 2019-02-28 20:34:07 +01:00
Daniel Marjamäki 857681a049 Make quick fix for uninitialized variable false positive. Will look more at this soon. 2019-02-28 09:52:52 +01:00
rikardfalkeborn c9efc26578 valueflow: Mark getLifetimeToken() static (#1703)
Fixes a compiler warning about missing declaration.
2019-02-26 23:35:11 +01:00
Paul Fultz II fd3c1fd040 Fix issue 1777: Undefined Behavior: Comparing pointers to different objects
This uses the lifetime analysis to check when comparing pointer that point to different objects:

```cpp
int main(void)
{
    int foo[10];
    int bar[10];
    int diff;

    if(foo > bar)   // Undefined Behavior
    {
       diff = 1;
    }

    return 0;
}
```
2019-02-23 08:32:08 +01:00
Paul Fultz II 507c7a4388 Improvement to lifetime tracking of addressof and derefencing
This will now warn for cases like this:

```cpp
auto& f() {
    std::vector<int> x;
    return x[0];
}
```

It also improves the handling of address of operator, so it can now warn across some function calls, like this:

```cpp
int& f(int& a) {
    return a;
}
int* hello() {
    int x = 0;
    return &f(x);
}
```
2019-02-22 06:38:56 +01:00
Paul Fultz II 715714f4de Forward lifetimes in "for" loops (#1682)
* Forward lifetimes in for loops

* Format
2019-02-22 06:37:02 +01:00
Daniel Marjamäki 9337af8965 astyle formatting 2019-02-09 08:48:10 +01:00
Paul Fultz II 797eccc203 Fix possible out of bounds access on arguments (#1652)
* Fix possible outbounds access on arguments

* Log a warning when the arguments mismatch

* Format
2019-02-09 08:47:36 +01:00
Daniel Marjamäki bd7790fd8c Update copyright year 2019-02-09 07:24:06 +01:00
Paul Fultz II c176775afb Avoid infinite recursion in getLifetimeVariable (#1634)
* Fix direct recursion

* Limit depth of getLifetimeVariable
2019-01-31 10:34:41 +01:00
Paul Fultz II 165a22ed0f Lifetime: Support analysis with functions that do not return a reference (#1632)
* Initial support for function return

* Add test case

* Add support for reference parameters

* Format
2019-01-29 09:47:52 +01:00
Paul Fultz II d6aaf401df Lifetime: Follow functions that return references
This will now warn for cases like this:

```cpp
int& f(int& a) {
    return a;
}
int& hello() {
    int x = 0;
    return f(x);
}
```
2019-01-26 11:03:57 +01:00
Paul Fultz II 3975913637 Extend lifetime checking for references
This will use the lifetime checker for dangling references. It will find these cases for indirectly assigned reference:

```cpp
int &foo()
{
    int s = 0;
    int& x = s;
    return x;
}
```

This will also fix issue 510 as well:

```cpp
int &f( int k )
{
    static int &r = k;
    return r;
}
```
2019-01-23 07:29:16 +01:00
Paul Fultz II 4b37f276c2 ValueFlow: Set arrays to true when converting to a boolean
This sets it by checking the parent. It doesn't handle function parameters yet.
2019-01-21 20:05:35 +01:00
Paul Fultz II 5fa956a597 Fix issue 8932: False positive knownConditionTrueFalse - valueflow ignores operator < (#1584) 2019-01-11 08:39:23 +01:00
practicalswift 0a1b3a9d6f Fix typos (#1568) 2019-01-06 17:15:57 +01:00
Daniel Marjamäki 5636497c0b Fixed #8863 (false positive: (warning) Accessing an item in container 's'. Either the condition 's.empty()' is redundant or 's' can be empty.) 2019-01-06 12:21:55 +01:00
Paul Fultz II bba6dfb8b2 Fix issue 4744: ValueFlow: known integer result
This fixes valueflow to have a value for `||` operator here:

```cpp
bool f()
{
	bool a = (4 == 3); // <-- 0
	bool b = (3 == 3); // <-- 1
	return a || b; // <-- 1
}
```
2019-01-03 07:05:31 +01:00
Daniel Marjamäki 2b63997c2c Fixed #8928 (false positive: (style) Variable 'x' is assigned a value that is never used.) 2019-01-02 20:23:02 +01:00
Daniel Marjamäki 39ceb53578 Comment out code in valueFlowArray. There was too many false positives. 2019-01-02 19:57:11 +01:00
Daniel Marjamäki 39a96a5a16 ValueFlow: Temporarily comment out valueFlowTerminatingCondition 2019-01-02 19:42:08 +01:00
Daniel Marjamäki 115be7dfc8 ValueFlow: better FwdAnalysis for complex expressions 2019-01-01 18:23:47 +01:00
Daniel Marjamäki be7afac875 ValueFlow: remove handling of == for complex expressions it did not work properly 2019-01-01 17:23:46 +01:00
Daniel Marjamäki 20436ea986 Fix compiler warning 2019-01-01 17:04:47 +01:00
rikardfalkeborn 13ffefc8b8 Valueflow: Fix right shift with more than 31 bits (#1553)
When comparing if the shift is large enough to make the result zero, use
an unsigned long long to make sure the result fits. Also, a check that
avoids setting the value if the shift is equal to or larger than the
number of bits in the operand (this is undefined behaviour). Finally,
add a check to make sure the calculated value is not too large to store.

Add test cases to cover this.

This was detected by an MSVC warning.

valueflow.cpp(1350): warning C4334: '<<' : result of 32-bit shift implicitly
                     converted to 64 bits (was 64-bit shift intended?)
2019-01-01 14:15:50 +01:00
Daniel Marjamäki ed514644b8 Renamed FwdAnalysisAllPaths to FwdAnalysis 2018-12-31 18:00:47 +01:00
Daniel Marjamäki 4918a18bfb ValueFlow: Value of expression after condition 2018-12-31 17:37:38 +01:00
Daniel Marjamäki 141ce7cd63 ValueFlow: Use FwdAnalysisAllPaths in ValueFlow to track complex expressions 2018-12-31 17:05:46 +01:00