Source Annotations

// No leak. · only

+$ cat test.m
+int bar(int*p, int q, int *r) __attribute__((nonnull(1,3)));
+
+int foo(int *p, int *q) {
+   return !p ? bar(q, 2, p) 
+             : bar(p, 2, q);
+}
+
scan-build
release
+$ cat test.m
+#import <Foundation/Foundation.h>
+
+#ifndef __has_feature      // Optional.
+#define __has_feature(x) 0 // Compatibility with non-clang compilers.
+#endif
+
+#ifndef NS_RETURNS_RETAINED
+#if __has_feature(attribute_ns_returns_retained)
+#define NS_RETURNS_RETAINED __attribute__((ns_returns_retained))
+#else
+#define NS_RETURNS_RETAINED
+#endif
+#endif
+
+@interface MyClass : NSObject {}
+- (NSString*) returnsRetained NS_RETURNS_RETAINED;
+- (NSString*) alsoReturnsRetained;
+@end
+
+@implementation MyClass
+- (NSString*) returnsRetained {
+  return [[NSString alloc] initWithCString:"no leak here"];
+}
+- (NSString*) alsoReturnsRetained {
+  return [[NSString alloc] initWithCString:"flag a leak"];
+}
+@end
+
scan-build
+$ cat test.m
+#ifndef __has_feature      // Optional.
+#define __has_feature(x) 0 // Compatibility with non-clang compilers.
+#endif
+
+#ifndef NS_RETURNS_NOT_RETAINED
+#if __has_feature(attribute_ns_returns_not_retained)
+#define NS_RETURNS_NOT_RETAINED __attribute__((ns_returns_not_retained))
+#else
+#define NS_RETURNS_NOT_RETAINED
+#endif
+#endif
+
release
CFRelease
CFMakeCollectable
-fobjc-gc-only
+$ cat test.m
+$ cat test.m
+#import <Cocoa/Cocoa.h>
+
+#ifndef __has_feature      // Optional.
+#define __has_feature(x) 0 // Compatibility with non-clang compilers.
+#endif
+
+#ifndef CF_RETURNS_RETAINED
+#if __has_feature(attribute_cf_returns_retained)
+#define CF_RETURNS_RETAINED __attribute__((cf_returns_retained))
+#else
+#define CF_RETURNS_RETAINED
+#endif
+#endif
+
+@interface MyClass : NSObject {}
+- (NSDate*) returnsCFRetained CF_RETURNS_RETAINED;
+- (NSDate*) alsoReturnsRetained;
+- (NSDate*) returnsNSRetained NS_RETURNS_RETAINED;
+@end
+
+CF_RETURNS_RETAINED
+CFDateRef returnsRetainedCFDate()  {
+  return CFDateCreate(0, CFAbsoluteTimeGetCurrent());
+}
+
+@implementation MyClass
+- (NSDate*) returnsCFRetained {
+  return (NSDate*) returnsRetainedCFDate(); // No leak.
+}
+
+- (NSDate*) alsoReturnsRetained {
+  return (NSDate*) returnsRetainedCFDate(); // Always report a leak.
+}
+
+- (NSDate*) returnsNSRetained {
+  return (NSDate*) returnsRetainedCFDate(); // Report a leak when using GC.
+}
+@end
+
scan-build
-fobjc-gc
-fobjc-gc-only
scan-build
+$ cat test.m
+#ifndef __has_feature      // Optional.
+#define __has_feature(x) 0 // Compatibility with non-clang compilers.
+#endif
+
+#ifndef CF_RETURNS_NOT_RETAINED
+#if __has_feature(attribute_cf_returns_not_retained)
+#define CF_RETURNS_NOT_RETAINED __attribute__((cf_returns_not_retained))
+#else
+#define CF_RETURNS_NOT_RETAINED
+#endif
+#endif
+
release
release
CFRelease
+$ cat test.m
+#ifndef __has_feature      // Optional.
+#define __has_feature(x) 0 // Compatibility with non-clang compilers.
+#endif
+
+#ifndef NS_CONSUMED
+#if __has_feature(attribute_ns_consumed)
+#define NS_CONSUMED __attribute__((ns_consumed))
+#else
+#define NS_CONSUMED
+#endif
+#endif
+
+void consume_ns(id NS_CONSUMED x);
+
+void test() {
+  id x = [[NSObject alloc] init];
+  consume_ns(x); // No leak!
+}
+
+@interface Foo : NSObject
++ (void) releaseArg:(id) NS_CONSUMED x;
++ (void) releaseSecondArg:(id)x second:(id) NS_CONSUMED y;
+@end
+
+void test_method() {
+  id x = [[NSObject alloc] init];
+  [Foo releaseArg:x]; // No leak!
+}
+
+void test_method2() {
+  id a = [[NSObject alloc] init];
+  id b = [[NSObject alloc] init];
+  [Foo releaseSecondArg:a second:b]; // 'a' is leaked, but 'b' is released.
+}
+
CFRelease
+$ cat test.m
+#ifndef __has_feature      // Optional.
+#define __has_feature(x) 0 // Compatibility with non-clang compilers.
+#endif
+
+#ifndef CF_CONSUMED
+#if __has_feature(attribute_cf_consumed)
+#define CF_CONSUMED __attribute__((cf_consumed))
+#else
+#define CF_CONSUMED
+#endif
+#endif
+
+void consume_cf(id CF_CONSUMED x);
+void consume_CFDate(CFDateRef CF_CONSUMED x);
+
+void test() {
+  id x = [[NSObject alloc] init];
+  consume_cf(x); // No leak!
+}
+
+void test2() {
+  CFDateRef date = CFDateCreate(0, CFAbsoluteTimeGetCurrent());
+  consume_CFDate(date); // No leak, including under GC!
+  
+}
+
+@interface Foo : NSObject
++ (void) releaseArg:(CFDateRef) CF_CONSUMED x;
+@end
+
+void test_method() {
+  CFDateRef date = CFDateCreate(0, CFAbsoluteTimeGetCurrent());
+  [Foo releaseArg:date]; // No leak!
+}
+
+#ifndef __has_feature
+#define __has_feature(x) 0 // Compatibility with non-clang compilers.
+#endif
+
+#ifndef NS_CONSUMES_SELF
+#if __has_feature((attribute_ns_consumes_self))
+#define NS_CONSUMES_SELF __attribute__((ns_consumes_self))
+#else
+#define NS_CONSUMES_SELF
+#endif
+#endif
+
+@interface MyClass : NSObject
+- initWith:(MyClass *)x;
+- nonstandardInitWith:(MyClass *)x NS_CONSUMES_SELF NS_RETURNS_RETAINED;
+@end
+
nonstandardInitWith:
initWith:
+void foo(int *p) {
+  assert(p != NULL);
+}
+
+void foo(int *p) {
+  (__builtin_expect(!(p != NULL), 0) ? __assert_rtn(__func__, "t.c", 4, "p != NULL") : (void)0);
+}
+
__assert_rtn
__assert_rtn
assert.h
+void __assert_rtn(const char *, const char *, int, const char *) __attribute__((__noreturn__));
+
+#ifndef CLANG_ANALYZER_NORETURN
+#if __has_feature(attribute_analyzer_noreturn)
+#define CLANG_ANALYZER_NORETURN __attribute__((analyzer_noreturn))
+#else
+#define CLANG_ANALYZER_NORETURN
+#endif
+#endif
+
+void my_assert_rtn(const char *, const char *, int, const char *) CLANG_ANALYZER_NORETURN;
+

+    $ cd llvm/tools/clang
+    
include/clang/StaticAnalyzer
lib/StaticAnalyzer
test/Analysis

+    $ cd ../../../; cd build/tools/clang; TESTDIRS=Analysis make test
+    

+    $ clang -cc1 -analyze -analyzer-checker=core.DivideZero test.c
+    

+    $ clang -cc1 -analyzer-checker-help
+    

+    $ clang -cc1 -help | grep "analyzer"
+    
ProgramPoint
ProgramState
ProgramPoint
PostPurgeDeadSymbolsKind
Environment
Store
GenericDataMap
ProgramState
GenericDataMap
ExplodedGraph
VarRegion
FieldRegion
VarRegion
MemRegion
+  int foo(int x) {
+     int y = x * 2;
+     int z = x;
+     ...
+  }
+  
x*2
x
SVal
x
SVal
MemRegion
x
SVal
x
x
$0
2
SVal
2
x*2
SVals
SVal
$1
y
MemRegion
SVal
$1
MemRegion
x
SVal
$0
SVals
clang/lib/StaticAnalyzer/Checkers
./lib/StaticAnalyzer/Checkers/NewChecker.cpp
+using namespace clang;
+using namespace ento;
+
+namespace {
+class NewChecker: public Checker< check::PreStmt<CallExpr> > {
+public:
+  void checkPreStmt(const CallExpr *CE, CheckerContext &Ctx) const {}
+}
+}
+void ento::registerNewChecker(CheckerManager &mgr) {
+  mgr.registerChecker<NewChecker>();
+}
+
./lib/StaticAnalyzer/Checkers/Checkers.td
SecurityExperimental
+let ParentPackage = SecurityExperimental in {
+...
+def NewChecker : Checker<"NewChecker">,
+  HelpText<"This text should give a short description of the checks performed.">,
+  DescFile<"NewChecker.cpp">;
+...
+} // end "security.experimental"
+
./lib/StaticAnalyzer/Checkers/CMakeLists.txt
$clang -cc1 -analyzer-checker-help
checkASTDecl
checkASTCodeBody
clang/test/Analysis
clang
+    $ TESTDIRS=Analysis make test
+    

+$ clang -cc1 -analyze -analyzer-checker=osx.KeychainAPI test.c
+

+$ clang -cc1 -ast-dump test.c
+
debug.ViewCFG
debug.DumpCFG

+$ clang -cc1 -analyze -analyzer-checker=debug.ViewCFG test.c
+

+$ clang -cc1 -analyzer-checker-help | grep "debug"
+
-analyzer-display-progress
clang -cc1 -analyze -analyzer-checker=core
clang --analyze
ExplodedGraph
clang::ento::ExprEngine
 
+(gdb) p ViewGraph(0)
+
ProgramState

+(gdb) p State->dump()
+
clang::Expr

+(gdb) p E->dump()
+
ExplodedNode

+(gdb) p C.getPredecessor()->getCodeDecl().getBody()->dump()
+(gdb) p C.getPredecessor()->getCodeDecl().getBody()->dump(getContext().getSourceManager())
+
new
delete
scan-build
checker-XXX.tar.bz2
checker-XXX
checker-XXX
checker-XXX
scan-build
scan-view
scan-build
scan-view
scan-build
scan-build
scan-view
scan-build
scan-build
scan-build
checker-XXX
scan-build
scan-build
scan-build
clang
clang
$(OBJDIR)/Debug+Asserts/bin
$(OBJDIR)
make install
configure
scan-build
scan-view
make install
$(SRCDIR)/tools/clang/tools/scan-build
$(SRCDIR)/tools/clang/tools/scan-view
$(SRCDIR)
checker-XXX
scan-build
set-xcode-analyzer
$ cd /Developer/Library
+$ find . | grep xcspec | grep Clang
+./Xcode/<SNIP>/Clang LLVM 1.0.xcplugin/Contents/Resources/Clang LLVM 1.0.xcspec
+
+  SourceFileOption = "--analyze";
+  FileTypes = (
+      "sourcecode.c.c",
+      "sourcecode.c.objc",
+  );
+  ...
+
+  FileTypes = (
+      "sourcecode.c.c",
+      "sourcecode.c.objc",
+      "sourcecode.cpp.cpp",
+      "sourcecode.cpp.objcpp",
+  );
+
i386
x86_64
ppc
-init
-init
CC
CXX
clang
gcc
scan-build
scan-build
scan-build
gcc
clang
scan-build
+$ scan-build make
+$ scan-build xcodebuild
+
scan-build
make
scan-build
xcodebuild
scan-build
+$ scan-build [scan-build options] <command> [command options]
+
scan-build
-j4
make
+$ scan-build make -j4
+
scan-build
scan-build
scan-build
+ $ scan-build gcc -c t1.c t2.c
+
t1.c
t2.c
scan-build
+ $ scan-build -k -V make
+ $ scan-build -k -V xcodebuild
+
/tmp
scan-build
make
xcodebuild
scan-build
index.html
index.html
scan-build
/tmp
scan-build
scan-build
scan-build
scan-build
scan-build
configure
configure
scan-build
+$ scan-build ./configure
+$ scan-build make
+
configure
scan-build
scan-build
scan-build
CC
ccc-analyzer
ccc-analyzer
clang
configure
configure
scan-build
ccc-analyzer
Debug
-configuration
+Debug
xcodebuild
Simulator
Don't Code Sign
+$ scan-build xcodebuild -configuration Debug -sdk iphonesimulator2.2
+
+$ scan-build xcodebuild -configuration Debug -sdk iphonesimulator3.0
+
clang
clang
gcc
gcc/clang
scan-build
--use-cc
--use-c++
xcodebuild
--use-cc
clang
clang
clang
set-xcode-analyzer
clang
+$ set-xcode-analyzer -h
+Usage: set-xcode-analyzer [options]
+
+Options:
+  -h, --help            show this help message and exit
+  --use-checker-build=PATH
+                        Use the Clang located at the provided absolute path,
+                        e.g. /Users/foo/checker-1
+  --use-xcode-clang     Use the Clang bundled with Xcode
+
/Developer
clang
clang
clang
set-xcode-analyzer
set-xcode-analyzer
sudo
+$ pwd
+/tmp
+$ tar xjf checker-235.tar.bz2
+$ sudo checker-235/set-xcode-analyzer --use-checker-build=/tmp/checker-235
+
/tmp
set-xcode-analyzer
clang
+$ sudo set-xcode-analyzer --use-checker-build=~/mycrazyclangbuild/bin/clang
+
+$ sudo set-xcode-analyzer --use-xcode-clang
+

core.AdjustedReturnValue	Check to see if the return value of a function call is different than the caller expects (e.g., from calls through function pointers).
core.AttributeNonNull	Check for null pointers passed as arguments to a function whose arguments are marked with the 'nonnull' attribute.
core.CallAndMessage	Check for logical errors for function calls and Objective-C message expressions (e.g., uninitialized arguments, null function pointers).
core.DivideZero	Check for division by zero.
core.NullDereference	Check for dereferences of null pointers.
core.StackAddressEscape	Check that addresses to stack memory do not escape the function.
core.UndefinedBinaryOperatorResult	Check for undefined results of binary operators.
core.VLASize	Check for declarations of VLA of undefined or zero size.
core.builtin.BuiltinFunctions	Evaluate compiler builtin functions (e.g., alloca()).
core.builtin.NoReturnFunctions	Evaluate "panic" functions that are known to not return to the caller.
core.uninitialized.ArraySubscript	Check for uninitialized values used as array subscripts.
core.uninitialized.Assign	Check for assigning uninitialized values.
core.uninitialized.Branch	Check for uninitialized values used as branch conditions.
core.uninitialized.CapturedBlockVariable	Check for blocks that capture uninitialized values.
core.uninitialized.UndefReturn	Check for uninitialized values being returned to the caller.
deadcode.DeadStores	Check for values stored to variables that are never read afterwards.
deadcode.IdempotentOperations	Warn about idempotent operations.
osx.API	Check for proper uses of various Mac OS X APIs.
osx.AtomicCAS	Evaluate calls to OSAtomic functions.
osx.SecKeychainAPI	Check for proper uses of Secure Keychain APIs.
osx.cocoa.AtSync	Check for null pointers used as mutexes for @synchronized.
osx.cocoa.ClassRelease	Check for sending 'retain', 'release', or 'autorelease' directly to a Class.
osx.cocoa.IncompatibleMethodTypes	Warn about Objective-C method signatures with type incompatibilities.
osx.cocoa.NSAutoreleasePool	Warn for suboptimal uses of NSAutoreleasePool in Objective-C GC mode.
osx.cocoa.NSError	Check usage of NSError** parameters.
osx.cocoa.NilArg	Check for prohibited nil arguments to ObjC method calls.
osx.cocoa.RetainCount	Check for leaks and improper reference count management.
osx.cocoa.UnusedIvars	Warn about private ivars that are never used.
osx.cocoa.VariadicMethodTypes	Check for passing non-Objective-C types to variadic methods that expect only Objective-C types.
osx.coreFoundation.CFError	Check usage of CFErrorRef* parameters.
osx.coreFoundation.CFNumber	Check for proper uses of CFNumberCreate.
osx.coreFoundation.CFRetainRelease	Check for null arguments to CFRetain/CFRelease.
unix.API	Check calls to various UNIX/Posix functions.

Option	Description
-o	Target directory for HTML report files. Subdirectories +will be created as needed to represent separate "runs" of the analyzer. If this +option is not specified, a directory is created in `/tmp` to store the +reports.
-h (or no arguments)	Display all +`scan-build` options.
-k --keep-going	Add a "keep on +going" option to the specified build command. This option currently supports +`make` and `xcodebuild`. This is a convenience option; one +can specify this behavior directly using build options.
-v	Verbose output from scan-build and the analyzer. A +second and third "-v" increases verbosity, and is useful for filing bug +reports against the analyzer.
-V	View analysis results in a web browser when the build +command completes.

Source Annotations

Specific Topics

Annotations to Enhance Generic Checks

Null Pointer Checking

Attribute 'nonnull'

Mac OS X API Annotations

Cocoa & Core Foundation Memory Management +Annotations

Attribute 'ns_returns_retained' +(Clang-specific)

Attribute 'ns_returns_not_retained' +(Clang-specific)

Attribute 'cf_returns_retained' +(Clang-specific)

Attribute 'cf_returns_not_retained' +(Clang-specific)

Attribute 'ns_consumed' +(Clang-specific)

Attribute 'cf_consumed' +(Clang-specific)

Attribute 'ns_consumes_self' +(Clang-specific)

Custom Assertion Handlers

Attribute 'noreturn'

Attribute 'analyzer_noreturn' (Clang-specific)

Available Checks

The list of the checks the analyzer performs by default

Writeups with examples of some of the bugs that the analyzer finds

This Page Is Under Construction

Checker Developer Manual

Getting Started

Static Analyzer Overview

Interaction with Checkers

Representing Values

Idea for a Checker

Checker Registration

Checker Skeleton

Bug Reports

AST Visitors

Testing

Useful Commands/Debugging Hints

C++ Support

Filing Bugs and Feature Requests

Outside of Apple

Bugzilla

Bugreporter.apple.com

Apple-internal Users

Clang Static Analyzer

Download

Mac OS X

Other Platforms

What is Static Analysis?

Part of Clang and LLVM

Important Points to Consider

Work-in-Progress

Slower than Compilation

False Positives

More Checks

Obtaining the Static Analyzer

Packaged Builds (Mac OS X)

Using Packaged Builds

Running scan-build

Other Platforms (Building the Analyzer from Source)

Release notes for checker-XXX builds

checker-263

checker-262

checker-261

checker-260

checker-259

checker-258

checker-257

checker-256

checker-255

checker-254

scan-build: running the analyzer from the command line

What is it?

How does it work?

Will it work with any build system?

Contents

Getting Started

Basic Usage

Other Options

Output of scan-build

Recommended Usage Guidelines

ALWAYS analyze a project in its "debug" configuration

Use verbose output when debugging scan-build

Run './configure' through scan-build

Analyzing iPhone Projects

Release notes for `checker-XXX` builds