You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: clang/docs/analyzer/checkers.rst
+60-73Lines changed: 60 additions & 73 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1332,10 +1332,69 @@ security
1332
1332
1333
1333
Security related checkers.
1334
1334
1335
+
.. _security-ArrayBound:
1336
+
1337
+
security.ArrayBound (C, C++)
1338
+
""""""""""""""""""""""""""""
1339
+
Report out of bounds access to memory that is before the start or after the end
1340
+
of the accessed region (array, heap-allocated region, string literal etc.).
1341
+
This usually means incorrect indexing, but the checker also detects access via
1342
+
the operators ``*`` and ``->``.
1343
+
1344
+
.. code-block:: c
1345
+
1346
+
void test_underflow(int x) {
1347
+
int buf[100][100];
1348
+
if (x < 0)
1349
+
buf[0][x] = 1; // warn
1350
+
}
1351
+
1352
+
void test_overflow() {
1353
+
int buf[100];
1354
+
int *p = buf + 100;
1355
+
*p = 1; // warn
1356
+
}
1357
+
1358
+
If checkers like :ref:`unix-Malloc` or :ref:`cplusplus-NewDelete` are enabled
1359
+
to model the behavior of ``malloc()``, ``operator new`` and similar
1360
+
allocators), then this checker can also reports out of bounds access to
1361
+
dynamically allocated memory:
1362
+
1363
+
.. code-block:: cpp
1364
+
1365
+
int *test_dynamic() {
1366
+
int *mem = new int[100];
1367
+
mem[-1] = 42; // warn
1368
+
return mem;
1369
+
}
1370
+
1371
+
In uncertain situations (when the checker can neither prove nor disprove that
1372
+
overflow occurs), the checker assumes that the the index (more precisely, the
1373
+
memory offeset) is within bounds.
1374
+
1375
+
However, if :ref:`optin-taint-GenericTaint` is enabled and the index/offset is
1376
+
tainted (i.e. it is influenced by an untrusted souce), then this checker
1377
+
reports the potential out of bounds access:
1378
+
1379
+
.. code-block:: c
1380
+
1381
+
void test_with_tainted_index() {
1382
+
char s[] = "abc";
1383
+
int x = getchar();
1384
+
char c = s[x]; // warn: potential out of bounds access with tainted index
1385
+
}
1386
+
1387
+
.. note::
1388
+
1389
+
This checker is an improved and renamed version of the checker that was
1390
+
previously known as ``alpha.security.ArrayBoundV2``. The old checker
1391
+
``alpha.security.ArrayBound`` was removed when the (previously
1392
+
"experimental") V2 variant became stable enough for regular use.
1393
+
1335
1394
.. _security-cert-env-InvalidPtr:
1336
1395
1337
1396
security.cert.env.InvalidPtr
1338
-
""""""""""""""""""""""""""""""""""
1397
+
""""""""""""""""""""""""""""
1339
1398
1340
1399
Corresponds to SEI CERT Rules `ENV31-C <https://wiki.sei.cmu.edu/confluence/display/c/ENV31-C.+Do+not+rely+on+an+environment+pointer+following+an+operation+that+may+invalidate+it>`_ and `ENV34-C <https://wiki.sei.cmu.edu/confluence/display/c/ENV34-C.+Do+not+store+pointers+returned+by+certain+functions>`_.
1341
1400
@@ -3216,78 +3275,6 @@ Warns against using one vs. many plural pattern in code when generating localize
0 commit comments