⚙ D8273 [analyzer] Implementation of potential undefbehavior.ZeroAllocDereference checker.
[analyzer] Implementation of potential undefbehavior.ZeroAllocDereference checker.
Authored by ayartsev on Mar 11 2015, 3:21 PM.
Proposed patch implements undefbehavior.ZeroAllocDereference checker as part of unix.Malloc and cplusplus.NewDelete checkers.
The patch doesn't handle zero-size realloc()s due to specifics of current handling of realloc() by unix.Malloc that need to be discussed.
ayartsev retitled this revision from to [analyzer] Implementation of potential undefbehavior.ZeroAllocDereference checker..
ayartsev added a reviewer: zaks.anna.
ayartsev added subscribers: jordan_rose, krememek, Unknown Object (MLST).
**As a rule of thumb, checkers should be stateless.
When you introduce mutable members you are most likely making a mistake. The state should track properties of symbols; specifically to check with symbol corresponds to a '0' allocation.
When the checker explores "malloc(s)" along the "s=0" path, the expression will be added to the set. If "*p = 1" along the "s=10" path is explored later on, we are going to produce a false positive.
Please, provide better testing so the cases like this one are exposed.
Aaa, I see, thank you!
Updated the patch, made the checker stateless, please review!
I think you could just fold it into the Kind, by adding AllocatedOfSizeZero or do we think that Relinquished or Escaped should be treated differently if they were zero allocated..?
"ProcessZeroAllocation" ? We are not checking anything here.
It should not be possible to have non allocated symbol here.. Is it? Maybe we should assert?
I's call this "Use of zero allocated" or "Zero allocation"
this seems unrelated to the patch. Can it be submitted separately with a testcase that it is trying to address?
Implemented with a new AllocatedOfSizeZero kind. Theoretically Relinquished may be treated differently if we would like to track usage of zero-allocated memory after relinquish but there are no cases yet.
New patch with comments addressed, please review!
Pardon, currently zero-allocated realloc do not attach a RefState so it is still early to assert for now.
make sure we test on real code before committing.
Other than testing, this looks good to me. Thank you!
ayartsev added a reviewer: ayartsev.