Available Checkers
The analyzer performs checks that are categorized into families or "checkers". The default set of checkers covers a variety of checks targeted at finding security and API usage bugs, dead code, and other logic errors. See the Default Checkers list below. In addition to these, the analyzer contains a number of Experimental (Alpha) Checkers.Writeups with examples of some of the bugs that the analyzer finds
- Bug Finding With Clang: 5 Resources To Get You Started
- Finding Memory Leaks With The LLVM/Clang Static Analyzer
- Under the Microscope - The Clang Static Analyzer
- Mike Ash - Using the Clang Static Analyzer
Default Checkers
- Core Checkers model core language features and perform general-purpose checks such as division by zero, null pointer dereference, usage of uninitialized values, etc.
- C++ Checkers perform C++-specific checks
- Dead Code Checkers check for unused code
- OS X Checkers perform Objective-C-specific checks and check the use of Apple's SDKs (OS X and iOS)
- Security Checkers check for insecure API usage and perform checks based on the CERT Secure Coding Standards
- Unix Checkers check the use of Unix and POSIX APIs
Core Checkers
| Name, Description | Example |
core.CallAndMessage
(C, C++, ObjC)
Check for logical errors for function calls and Objective-C message expressions
(e.g., uninitialized arguments, null function pointers). |
// C
struct S {
int x;
};
void f(struct S s);
void test() {
struct S s;
f(s); // warn: passed-by-value arg contain uninitialized data
}
// C
void test() {
void (*foo)(void);
foo(); // warn: function pointer is uninitialized
}
// C
void test() {
void (*foo)(void);
foo = 0;
foo(); // warn: function pointer is null
}
// C++
class C {
public:
void f();
};
void test() {
C *pc;
pc->f(); // warn: object pointer is uninitialized
}
// C++
class C {
public:
void f();
};
void test() {
C *pc = 0;
pc->f(); // warn: object pointer is null
}
// Objective-C
@interface MyClass : NSObject
@property (readwrite,assign) id x;
- (long double)longDoubleM;
@end
void test() {
MyClass *obj1;
long double ld1 = [obj1 longDoubleM];
// warn: receiver is uninitialized
}
// Objective-C
@interface MyClass : NSObject
@property (readwrite,assign) id x;
- (long double)longDoubleM;
@end
void test() {
MyClass *obj1;
id i = obj1.x; // warn: uninitialized object pointer
}
// Objective-C
@interface Subscriptable : NSObject
- (id)objectAtIndexedSubscript:(unsigned int)index;
@end
@interface MyClass : Subscriptable
@property (readwrite,assign) id x;
- (long double)longDoubleM;
@end
void test() {
MyClass *obj1;
id i = obj1[0]; // warn: uninitialized object pointer
}
|
core.DivideZero
(C, C++, ObjC)
Check for division by zero. |
void test(int z) {
if (z == 0)
int x = 1 / z; // warn
}
void test() {
int x = 1;
int y = x % 0; // warn
}
|
core.NonNullParamChecker
(C, C++, ObjC)
Check for null pointers passed as arguments to a function whose arguments are
marked with the nonnull attribute. |
int f(int *p) __attribute__((nonnull));
void test(int *p) {
if (!p)
f(p); // warn
}
|
core.NullDereference
(C, C++, ObjC)
Check for dereferences of null pointers. |
// C
void test(int *p) {
if (p)
return;
int x = p[0]; // warn
}
// C
void test(int *p) {
if (!p)
*p = 0; // warn
}
// C++
class C {
public:
int x;
};
void test() {
C *pc = 0;
int k = pc->x; // warn
}
// Objective-C
@interface MyClass {
@public
int x;
}
@end
void test() {
MyClass *obj = 0;
obj->x = 1; // warn
}
|
core.StackAddressEscape
(C)
Check that addresses of stack memory do not escape the function. |
char const *p;
void test() {
char const str[] = "string";
p = str; // warn
}
void* test() {
return __builtin_alloca(12); // warn
}
void test() {
static int *x;
int y;
x = &y; // warn
}
|
core.UndefinedBinaryOperatorResult
(C)
Check for undefined results of binary operators. |
void test() {
int x;
int y = x + 1; // warn: left operand is garbage
}
|
core.VLASize
(C)
Check for declarations of VLA of undefined or zero size. |
void test() {
int x;
int vla1[x]; // warn: garbage as size
}
void test() {
int x = 0;
int vla2[x]; // warn: zero size
}
|
core.uninitialized.ArraySubscript
(C)
Check for uninitialized values used as array subscripts. |
void test() {
int i, a[10];
int x = a[i]; // warn: array subscript is undefined
}
|
core.uninitialized.Assign
(C)
Check for assigning uninitialized values. |
void test() {
int x;
x |= 1; // warn: left expression is unitialized
}
|
core.uninitialized.Branch
(C)
Check for uninitialized values used as branch conditions. |
void test() {
int x;
if (x) // warn
return;
}
|
core.uninitialized.CapturedBlockVariable
(C)
Check for blocks that capture uninitialized values. |
void test() {
int x;
^{ int y = x; }(); // warn
}
|
core.uninitialized.UndefReturn
(C)
Check for uninitialized values being returned to the caller. |
int test() {
int x;
return x; // warn
}
|
C++ Checkers
| Name, Description | Example |
cplusplus.NewDelete
(C++)
Check for double-free, use-after-free and offset problems involving C++
delete. |
void f(int *p);
void testUseMiddleArgAfterDelete(int *p) {
delete p;
f(p); // warn: use after free
}
class SomeClass {
public:
void f();
};
void test() {
SomeClass *c = new SomeClass;
delete c;
c->f(); // warn: use after free
}
void test() {
int *p = (int *)__builtin_alloca(sizeof(int));
delete p; // warn: deleting memory allocated by alloca
}
void test() {
int *p = new int;
delete p;
delete p; // warn: attempt to free released
}
void test() {
int i;
delete &i; // warn: delete address of local
}
void test() {
int *p = new int[1];
delete[] (++p);
// warn: argument to 'delete[]' is offset by 4 bytes
// from the start of memory allocated by 'new[]'
}
|
Dead Code Checkers
| Name, Description | Example |
deadcode.DeadStores
(C)
Check for values stored to variables that are never read afterwards. |
void test() {
int x;
x = 1; // warn
}
|
OS X Checkers
| Name, Description | Example |
osx.API
(C)
Check for proper uses of various Apple APIs:
dispatch_once |
void test() {
dispatch_once_t pred = 0;
dispatch_once(&pred, ^(){}); // warn: dispatch_once uses local
}
|
osx.SecKeychainAPI
(C)
Check for improper uses of the Security framework's Keychain APIs:
SecKeychainItemCopyContent SecKeychainFindGenericPassword SecKeychainFindInternetPassword SecKeychainItemFreeContent SecKeychainItemCopyAttributesAndData SecKeychainItemFreeAttributesAndData |
void test() {
unsigned int *ptr = 0;
UInt32 length;
SecKeychainItemFreeContent(ptr, &length);
// warn: trying to free data which has not been allocated
}
void test() {
unsigned int *ptr = 0;
UInt32 *length = 0;
void *outData;
OSStatus st =
SecKeychainItemCopyContent(2, ptr, ptr, length, outData);
// warn: data is not released
}
void test() {
unsigned int *ptr = 0;
UInt32 *length = 0;
void *outData;
OSStatus st =
SecKeychainItemCopyContent(2, ptr, ptr, length, &outData);
SecKeychainItemFreeContent(ptr, outData);
// warn: only call free if a non-NULL buffer was returned
}
void test() {
unsigned int *ptr = 0;
UInt32 *length = 0;
void *outData;
OSStatus st =
SecKeychainItemCopyContent(2, ptr, ptr, length, &outData);
st = SecKeychainItemCopyContent(2, ptr, ptr, length, &outData);
// warn: release data before another call to the allocator
if (st == noErr)
SecKeychainItemFreeContent(ptr, outData);
}
void test() {
SecKeychainItemRef itemRef = 0;
SecKeychainAttributeInfo *info = 0;
SecItemClass *itemClass = 0;
SecKeychainAttributeList *attrList = 0;
UInt32 *length = 0;
void *outData = 0;
OSStatus st =
SecKeychainItemCopyAttributesAndData(itemRef, info,
itemClass, &attrList,
length, &outData);
SecKeychainItemFreeContent(attrList, outData);
// warn: deallocator doesn't match the allocator
}
|
osx.cocoa.AtSync
(ObjC)
Check for nil pointers used as mutexes for @synchronized. |
void test(id x) {
if (!x)
@synchronized(x) {} // warn: nil value used as mutex
}
void test() {
id y;
@synchronized(y) {} // warn: uninitialized value used as mutex
}
|
osx.cocoa.ClassRelease
(ObjC)
Check for sending retain, release, or
autorelease directly to a class. |
@interface MyClass : NSObject
@end
void test(void) {
[MyClass release]; // warn
}
|
osx.cocoa.IncompatibleMethodTypes
(ObjC)
Check for an incompatible type signature when overriding an Objective-C method. |
@interface MyClass1 : NSObject
- (int)foo;
@end
@implementation MyClass1
- (int)foo { return 1; }
@end
@interface MyClass2 : MyClass1
- (float)foo;
@end
@implementation MyClass2
- (float)foo { return 1.0; } // warn
@end
|
alpha.osx.cocoa.MissingSuperCall
(ObjC)
Warn about Objective-C methods that lack a necessary call to super. (Note: The
compiler now has a warning for methods annotated with objc_requires_super
attribute. The checker exists to check methods in the Cocoa frameworks
that haven't yet adopted this attribute.) |
@interface Test : UIViewController
@end
@implementation test
- (void)viewDidLoad {} // warn
@end
|
osx.cocoa.NSAutoreleasePool
(ObjC)
Warn for suboptimal uses of NSAutoreleasePool in Objective-C
GC mode ( -fobjc-gc compiler option). |
void test() {
NSAutoreleasePool *pool = [[NSAutoreleasePool alloc] init];
[pool release]; // warn
}
|
osx.cocoa.NSError
(ObjC)
Check usage of NSError** parameters. |
@interface A : NSObject
- (void)foo:(NSError **)error;
@end
@implementation A
- (void)foo:(NSError **)error {
// warn: method accepting NSError** should have a non-void
// return value
}
@end
@interface A : NSObject
- (BOOL)foo:(NSError **)error;
@end
@implementation A
- (BOOL)foo:(NSError **)error {
*error = 0; // warn: potential null dereference
return 0;
}
@end
|
osx.cocoa.NilArg
(ObjC)
Check for prohibited nil arguments in specific Objective-C method calls:
- caseInsensitiveCompare: - compare: - compare:options: - compare:options:range: - compare:options:range:locale: - componentsSeparatedByCharactersInSet: - initWithFormat: |
NSComparisonResult test(NSString *s) {
NSString *aString = nil;
return [s caseInsensitiveCompare:aString];
// warn: argument to 'NSString' method
// 'caseInsensitiveCompare:' cannot be nil
}
|
osx.cocoa.RetainCount
(ObjC)
Check for leaks and violations of the Cocoa Memory Management rules. |
void test() {
NSString *s = [[NSString alloc] init]; // warn
}
CFStringRef test(char *bytes) {
return CFStringCreateWithCStringNoCopy(
0, bytes, NSNEXTSTEPStringEncoding, 0); // warn
}
|
osx.cocoa.SelfInit
(ObjC)
Check that self is properly initialized inside an initializer
method. |
@interface MyObj : NSObject {
id x;
}
- (id)init;
@end
@implementation MyObj
- (id)init {
[super init];
x = 0; // warn: instance variable used while 'self' is not
// initialized
return 0;
}
@end
@interface MyObj : NSObject
- (id)init;
@end
@implementation MyObj
- (id)init {
[super init];
return self; // warn: returning uninitialized 'self'
}
@end
|
osx.cocoa.UnusedIvars
(ObjC)
Warn about private ivars that are never used. |
@interface MyObj : NSObject {
@private
id x; // warn
}
@end
@implementation MyObj
@end
|
osx.cocoa.VariadicMethodTypes
(ObjC)
Check for passing non-Objective-C types to variadic collection initialization
methods that expect only Objective-C types. |
void test() {
[NSSet setWithObjects:@"Foo", "Bar", nil];
// warn: argument should be an ObjC pointer type, not 'char *'
}
|
osx.coreFoundation.CFError
(C)
Check usage of CFErrorRef* parameters. |
void test(CFErrorRef *error) {
// warn: function accepting CFErrorRef* should have a
// non-void return
}
int foo(CFErrorRef *error) {
*error = 0; // warn: potential null dereference
return 0;
}
|
osx.coreFoundation.CFNumber
(C)
Check for improper uses of CFNumberCreate. |
CFNumberRef test(unsigned char x) {
return CFNumberCreate(0, kCFNumberSInt16Type, &x);
// warn: 8 bit integer is used to initialize a 16 bit integer
}
|
osx.coreFoundation.CFRetainRelease
(C)
Check for null arguments to CFRetain, CFRelease,
CFMakeCollectable. |
void test(CFTypeRef p) {
if (!p)
CFRetain(p); // warn
}
void test(int x, CFTypeRef p) {
if (p)
return;
CFRelease(p); // warn
}
|
osx.coreFoundation.containers.OutOfBounds
(C)
Checks for index out-of-bounds when using CFArray API. |
void test() {
CFArrayRef A = CFArrayCreate(0, 0, 0, &kCFTypeArrayCallBacks);
CFArrayGetValueAtIndex(A, 0); // warn
}
|
osx.coreFoundation.containers.PointerSizedValues
(C)
Warns if CFArray, CFDictionary, CFSet are
created with non-pointer-size values. |
void test() {
int x[] = { 1 };
CFArrayRef A = CFArrayCreate(0, (const void **)x, 1,
&kCFTypeArrayCallBacks); // warn
}
|
Security Checkers
| Name, Description | Example |
security.FloatLoopCounter
(C)
Warn on using a floating point value as a loop counter (CERT: FLP30-C,
FLP30-CPP). |
void test() {
for (float x = 0.1f; x <= 1.0f; x += 0.1f) {} // warn
}
|
security.insecureAPI.UncheckedReturn
(C)
Warn on uses of functions whose return values must be always checked:
setuid setgid seteuid setegid setreuid setregid |
void test() {
setuid(1); // warn
}
|
security.insecureAPI.getpw
(C)
Warn on uses of the getpw function. |
void test() {
char buff[1024];
getpw(2, buff); // warn
}
|
security.insecureAPI.gets
(C)
Warn on uses of the gets function. |
void test() {
char buff[1024];
gets(buff); // warn
}
|
security.insecureAPI.mkstemp
(C)
Warn when mktemp, mkstemp, mkstemps or
mkdtemp is passed fewer than 6
X's in the format string. |
void test() {
mkstemp("XX"); // warn
}
|
security.insecureAPI.mktemp
(C)
Warn on uses of the mktemp function. |
void test() {
char *x = mktemp("/tmp/zxcv"); // warn: insecure, use mkstemp
}
|
security.insecureAPI.rand
(C)
Warn on uses of inferior random number generating functions (only if arc4random
function is available):
drand48 erand48 jrand48 lcong48 lrand48 mrand48 nrand48 random rand_r |
void test() {
random(); // warn
}
|
security.insecureAPI.strcpy
(C)
Warn on uses of the strcpy and strcat functions. |
void test() {
char x[4];
char *y = "abcd";
strcpy(x, y); // warn
}
|
security.insecureAPI.vfork
(C)
Warn on uses of the vfork function. |
void test() {
vfork(); // warn
}
|
Unix Checkers
| Name, Description | Example |
unix.API
(C)
Check calls to various UNIX/POSIX functions:
open pthread_once calloc malloc realloc alloca
// Currently the check is performed for apple targets only.
void test(const char *path) {
int fd = open(path, O_CREAT);
// warn: call to 'open' requires a third argument when the
// 'O_CREAT' flag is set
}
void f();
void test() {
pthread_once_t pred = {0x30B1BCBA, {0}};
pthread_once(&pred, f);
// warn: call to 'pthread_once' uses the local variable
}
void test() {
void *p = malloc(0); // warn: allocation size of 0 bytes
}
void test() {
void *p = calloc(0, 42); // warn: allocation size of 0 bytes
}
void test() {
void *p = malloc(1);
p = realloc(p, 0); // warn: allocation size of 0 bytes
}
void test() {
void *p = alloca(0); // warn: allocation size of 0 bytes
}
void test() {
void *p = valloc(0); // warn: allocation size of 0 bytes
}
| |
unix.Malloc
(C)
Check for memory leaks, double free, and use-after-free and offset problems
involving malloc. |
void test() {
int *p = malloc(1);
free(p);
free(p); // warn: attempt to free released memory
}
void test() {
int *p = malloc(sizeof(int));
free(p);
*p = 1; // warn: use after free
}
void test() {
int *p = malloc(1);
if (p)
return; // warn: memory is never released
}
void test() {
int a[] = { 1 };
free(a); // warn: argument is not allocated by malloc
}
void test() {
int *p = malloc(sizeof(char));
p = p - 1;
free(p); // warn: argument to free() is offset by -4 bytes
}
|
unix.MallocSizeof
(C)
Check for dubious malloc, calloc or
realloc arguments involving sizeof. |
void test() {
long *p = malloc(sizeof(short));
// warn: result is converted to 'long *', which is
// incompatible with operand type 'short'
free(p);
}
|
unix.MismatchedDeallocator
(C, C++, ObjC)
Check for mismatched deallocators (e.g. passing a pointer allocating
with new to free()). |
// C, C++
void test() {
int *p = (int *)malloc(sizeof(int));
delete p; // warn
}
// C, C++
void __attribute((ownership_returns(malloc))) *user_malloc(size_t);
void test() {
int *p = (int *)user_malloc(sizeof(int));
delete p; // warn
}
// C, C++
void test() {
int *p = new int;
free(p); // warn
}
// C, C++
void test() {
int *p = new int[1];
realloc(p, sizeof(long)); // warn
}
// C, C++
template <typename T>
struct SimpleSmartPointer {
T *ptr;
explicit SimpleSmartPointer(T *p = 0) : ptr(p) {}
~SimpleSmartPointer() {
delete ptr; // warn
}
};
void test() {
SimpleSmartPointer<int> a((int *)malloc(4));
}
// C++
void test() {
int *p = (int *)operator new(0);
delete[] p; // warn
}
// Objective-C, C++
void test(NSUInteger dataLength) {
int *p = new int;
NSData *d = [NSData dataWithBytesNoCopy:p
length:sizeof(int) freeWhenDone:1];
// warn +dataWithBytesNoCopy:length:freeWhenDone: cannot take
// ownership of memory allocated by 'new'
}
|
unix.cstring.BadSizeArg
(C)
Check the size argument passed to strncat for common erroneous
patterns. Use -Wno-strncat-size compiler option to mute other
strncat-related compiler warnings.
|
void test() {
char dest[3];
strncat(dest, "***", sizeof(dest));
// warn: potential buffer overflow
}
|
unix.cstring.NullArg
(C)
Check for null pointers being passed as arguments to C string functions:
strlen strnlen strcpy strncpy strcat strncat strcmp strncmp strcasecmp strncasecmp |
int test() {
return strlen(0); // warn
}
|