Alpha Checks

# Alpha Checkers

Experimental checkers in addition to the Default Checkers. These are checkers with known issues or limitations that keep them from being on by default. They are likely to have false positives. Bug reports are welcome but will likely not be investigated for some time. Patches welcome!

- Core Alpha Checkers
- C++ Alpha Checkers
- Variable Argument Alpha Checkers
- Dead Code Alpha Checkers
- OS X Alpha Checkers
- Security Alpha Checkers
- Unix Alpha Checkers

### Core Alpha Checkers

Name, Description | Example
alpha.core.BoolAssignment (ObjC) Warn about assigning non-{0,1} values to boolean variables. |
    void test() {
      BOOL b = -1; // warn
    }
alpha.core.CastSize (C) Check when casting a malloc'ed type T, whether the size is a multiple of the size of T (Works only with unix.Malloc or alpha.unix.MallocWithAnnotations checks enabled). |
    void test() {
      int *x = (int *)malloc(11); // warn
    }
alpha.core.CastToStruct (C, C++) Check for cast from non-struct pointer to struct pointer. |
    // C
    struct s {};

    void test(int *p) {
      struct s *ps = (struct s *) p; // warn
    }
    // C++
    class c {};

    void test(int *p) {
      c *pc = (c *) p; // warn
    }
alpha.core.FixedAddr (C) Check for assignment of a fixed address to a pointer. |
    void test() {
      int *p;
      p = (int *) 0x10000; // warn
    }
alpha.core.IdenticalExpr (C, C++) Warn about suspicious uses of identical expressions. |
    // C
    void test() {
      int a = 5;
      int b = a | 4 | a; // warn: identical expr on both sides
    }
    // C++
    bool f(void);

    void test(bool b) {
      int i = 10;
      if (f()) { // warn: true and false branches are identical
        do {
          i--;
        } while (f());
      } else {
        do {
          i--;
        } while (f());
      }
    }
alpha.core.PointerArithm (C) Check for pointer arithmetic on locations other than array elements. |
    void test() {
      int x;
      int *p;
      p = &x + 1; // warn
    }
alpha.core.PointerSub (C) Check for pointer subtractions on two pointers pointing to different memory chunks. |
    void test() {
      int x, y;
      int d = &y - &x; // warn
    }
alpha.core.SizeofPtr (C) Warn about unintended use of `sizeof()` on pointer expressions. |
    struct s {};

    int test(struct s *p) {
      return sizeof(p);
        // warn: sizeof(ptr) can produce an unexpected result
    }

### C++ Alpha Checkers

Name, Description | Example
alpha.cplusplus.NewDeleteLeaks (C++) Check for memory leaks. Traces memory managed by `new`/`delete`. |
    void test() {
      int *p = new int;
    } // warn
alpha.cplusplus.VirtualCall (C++) Check virtual member function calls during construction or destruction. |
    class A {
    public:
      A() {
        f(); // warn
      }
      virtual void f();
    };
    class A {
    public:
      ~A() {
        this->f(); // warn
      }
      virtual void f();
    };

### Variable Argument Alpha Checkers

Name, Description | Example
alpha.valist.CopyToSelf (C) Calls to the `va_copy` macro should not copy onto itself. |
    #include <stdarg.h>

    void test(int x, ...) {
      va_list args;
      va_start(args, x);
      va_copy(args, args); // warn
      va_end(args);
    }
alpha.valist.Uninitialized (C) Calls to the `va_arg`, `va_copy`, or `va_end` macro must happen after calling `va_start` and before calling `va_end`. |
    #include <stdarg.h>

    void test(int x, ...) {
      va_list args;
      int y = va_arg(args, int); // warn
    }
    #include <stdarg.h>

    void test(int x, ...) {
      va_list args;
      va_start(args, x);
      va_end(args);
      int z = va_arg(args, int); // warn
    }
alpha.valist.Unterminated (C) Every `va_start` must be matched by a `va_end`. A va_list can only be ended once. |
    #include <stdarg.h>

    void test(int x, ...) {
      va_list args;
      va_start(args, x);
      int y = x + va_arg(args, int);
    } // warn: missing va_end

### Dead Code Alpha Checkers

Name, Description | Example
alpha.deadcode.UnreachableCode (C, C++, ObjC) Check unreachable code. |
    // C
    int test() {
      int x = 1;
      while(x);
      return x; // warn
    }
    // C++
    void test() {
      int a = 2;

      while (a > 1)
        a--;

      if (a > 1)
        a++; // warn
    }
    // Objective-C
    void test(id x) {
      return;
      [x retain]; // warn
    }

### OS X Alpha Checkers

Name, Description | Example
alpha.osx.cocoa.Dealloc (ObjC) Warn about Objective-C classes that lack a correct implementation of `-dealloc`. |
    @interface MyObject : NSObject {
      id _myproperty;
    }
    @end

    @implementation MyObject // warn: lacks 'dealloc'
    @end
    @interface MyObject : NSObject {}
    @property(assign) id myproperty;
    @end

    @implementation MyObject // warn: does not send 'dealloc' to super
    - (void)dealloc {
      self.myproperty = 0;
    }
    @end
    @interface MyObject : NSObject {
      id _myproperty;
    }
    @property(retain) id myproperty;
    @end

    @implementation MyObject
    @synthesize myproperty = _myproperty;
      // warn: var was retained but wasn't released
    - (void)dealloc {
      [super dealloc];
    }
    @end
    @interface MyObject : NSObject {
      id _myproperty;
    }
    @property(assign) id myproperty;
    @end

    @implementation MyObject
    @synthesize myproperty = _myproperty;
      // warn: var wasn't retained but was released
    - (void)dealloc {
      [_myproperty release];
      [super dealloc];
    }
    @end
alpha.osx.cocoa.DirectIvarAssignment (ObjC) Check that Objective C properties follow the following rule: the property should be set with the setter, not though a direct assignment. |
    @interface MyClass : NSObject {}
    @property (readonly) id A;
    - (void) foo;
    @end

    @implementation MyClass
    - (void) foo {
      _A = 0; // warn
    }
    @end
alpha.osx.cocoa.DirectIvarAssignmentForAnnotatedFunctions (ObjC) Check for direct assignments to instance variables in the methods annotated with `objc_no_direct_instance_variable_assignment`. |
    @interface MyClass : NSObject {}
    @property (readonly) id A;
    - (void) fAnnotated __attribute__((
        annotate("objc_no_direct_instance_variable_assignment")));
    - (void) fNotAnnotated;
    @end

    @implementation MyClass
    - (void) fAnnotated {
      _A = 0; // warn
    }
    - (void) fNotAnnotated {
      _A = 0; // no warn
    }
    @end
alpha.osx.cocoa.InstanceVariableInvalidation (ObjC) Check that the invalidatable instance variables are invalidated in the methods annotated with `objc_instance_variable_invalidator`. |
    @protocol Invalidation <NSObject>
    - (void) invalidate
      __attribute__((annotate("objc_instance_variable_invalidator")));
    @end

    @interface InvalidationImpObj : NSObject <Invalidation>
    @end

    @interface SubclassInvalidationImpObj : InvalidationImpObj {
      InvalidationImpObj *var;
    }
    - (void)invalidate;
    @end

    @implementation SubclassInvalidationImpObj
    - (void) invalidate {}
    @end
    // warn: var needs to be invalidated or set to nil
alpha.osx.cocoa.MissingInvalidationMethod (ObjC) Check that the invalidation methods are present in classes that contain invalidatable instance variables. |
    @protocol Invalidation <NSObject>
    - (void)invalidate
      __attribute__((annotate("objc_instance_variable_invalidator")));
    @end

    @interface NeedInvalidation : NSObject <Invalidation>
    @end

    @interface MissingInvalidationMethodDecl : NSObject {
      NeedInvalidation *Var; // warn
    }
    @end

    @implementation MissingInvalidationMethodDecl
    @end

### Security Alpha Checkers

Name, Description | Example
alpha.security.ArrayBound (C) Warn about buffer overflows (older checker). |
    void test() {
      char *s = "";
      char c = s[1]; // warn
    }
    struct seven_words {
      int c[7];
    };

    void test() {
      struct seven_words a, *p;
      p = &a;
      p[0] = a;
      p[1] = a;
      p[2] = a; // warn
    }
    // note: requires unix.Malloc or
    // alpha.unix.MallocWithAnnotations checks enabled.
    void test() {
      int *p = malloc(12);
      p[3] = 4; // warn
    }
    void test() {
      char a[2];
      int *b = (int*)a;
      b[1] = 3; // warn
    }
alpha.security.ArrayBoundV2 (C) Warn about buffer overflows (newer checker). |
    void test() {
      char *s = "";
      char c = s[1]; // warn
    }
    void test() {
      int buf[100];
      int *p = buf;
      p = p + 99;
      p[1] = 1; // warn
    }
    // note: compiler has internal check for this.
    // Use -Wno-array-bounds to suppress compiler warning.
    void test() {
      int buf[100][100];
      buf[0][-1] = 1; // warn
    }
    // note: requires alpha.security.taint check turned on.
    void test() {
      char s[] = "abc";
      int x = getchar();
      char c = s[x]; // warn: index is tainted
    }
alpha.security.MallocOverflow (C) Check for overflows in the arguments to `malloc()`. |
    void test(int n) {
      void *p = malloc(n * sizeof(int)); // warn
    }
alpha.security.ReturnPtrRange (C) Check for an out-of-bound pointer being returned to callers. |
    static int A[10];

    int *test() {
      int *p = A + 10;
      return p; // warn
    }
    int test(void) {
      int x;
      return x; // warn: undefined or garbage returned
    }
alpha.security.taint.TaintPropagation (C) Generate taint information used by other checkers. |
    void test() {
      char x = getchar(); // 'x' marked as tainted
      system(&x); // warn: untrusted data is passed to a system call
    }
    // note: compiler internally checks if the second param to
    // sprintf is a string literal or not.
    // Use -Wno-format-security to suppress compiler warning.
    void test() {
      char s[10], buf[10];
      fscanf(stdin, "%s", s); // 's' marked as tainted

      sprintf(buf, s); // warn: untrusted data as a format string
    }
    void test() {
      size_t ts;
      scanf("%zd", &ts); // 'ts' marked as tainted
      int *p = (int *)malloc(ts * sizeof(int));
        // warn: untrusted data as bufer size
    }

### Unix Alpha Checkers

Name, Description | Example
alpha.unix.Chroot (C) Check improper use of `chroot`. |
    void f();

    void test() {
      chroot("/usr/local");
      f(); // warn: no call of chdir("/") immediately after chroot
    }
alpha.unix.MallocWithAnnotations (C) Check for memory leaks, double free, and use-after-free problems. Assumes that all user-defined functions which might free a pointer are annotated. |
    void __attribute((ownership_returns(malloc))) *my_malloc(size_t);

    void test() {
      int *p = my_malloc(1);
    } // warn: potential leak
    void __attribute((ownership_returns(malloc))) *my_malloc(size_t);
    void __attribute((ownership_takes(malloc, 1))) my_free(void *);

    void test() {
      int *p = my_malloc(1);
      my_free(p);
      my_free(p); // warn: attempt to free released
    }
    void __attribute((ownership_returns(malloc))) *my_malloc(size_t);
    void __attribute((ownership_holds(malloc, 1))) my_hold(void *);

    void test() {
      int *p = my_malloc(1);
      my_hold(p);
      free(p); // warn: attempt to free non-owned memory
    }
    void __attribute((ownership_takes(malloc, 1))) my_free(void *);

    void test() {
      int *p = malloc(1);
      my_free(p);
      *p = 1; // warn: use after free
    }
alpha.unix.PthreadLock (C) Simple lock -> unlock checker; applies to: pthread_mutex_lock pthread_rwlock_rdlock pthread_rwlock_wrlock lck_mtx_lock lck_rw_lock_exclusive lck_rw_lock_shared pthread_mutex_trylock pthread_rwlock_tryrdlock pthread_rwlock_tryrwlock lck_mtx_try_lock lck_rw_try_lock_exclusive lck_rw_try_lock_shared pthread_mutex_unlock pthread_rwlock_unlock lck_mtx_unlock lck_rw_done |
    pthread_mutex_t mtx;

    void test() {
      pthread_mutex_lock(&mtx);
      pthread_mutex_lock(&mtx);
        // warn: this lock has already been acquired
    }
    lck_mtx_t lck1, lck2;

    void test() {
      lck_mtx_lock(&lck1);
      lck_mtx_lock(&lck2);
      lck_mtx_unlock(&lck1);
        // warn: this was not the most recently acquired lock
    }
    lck_mtx_t lck1, lck2;

    void test() {
      if (lck_mtx_try_lock(&lck1) == 0)
        return;

      lck_mtx_lock(&lck2);
      lck_mtx_unlock(&lck1);
        // warn: this was not the most recently acquired lock
    }
alpha.unix.SimpleStream (C) Check for misuses of stream APIs: fopen fclose (demo checker, the subject of the demo (Slides ,Video) by Anna Zaks and Jordan Rose presented at the 2012 LLVM Developers' Meeting). |
    void test() {
      FILE *F = fopen("myfile.txt", "w");
    } // warn: opened file is never closed
    void test() {
      FILE *F = fopen("myfile.txt", "w");

      if (F)
        fclose(F);

      fclose(F); // warn: closing a previously closed file stream
    }
alpha.unix.Stream (C) Check stream handling functions: fopen tmpfile fclose fread fwrite fseek ftell rewind fgetpos fsetpos clearerr feof ferror fileno |
    void test() {
      FILE *p = fopen("foo", "r");
    } // warn: opened file is never closed
    void test() {
      FILE *p = fopen("foo", "r");
      fseek(p, 1, SEEK_SET); // warn: stream pointer might be NULL
      fclose(p);
    }
    void test() {
      FILE *p = fopen("foo", "r");

      if (p)
        fseek(p, 1, 3);
         // warn: third arg should be SEEK_SET, SEEK_END, or SEEK_CUR

      fclose(p);
    }
    void test() {
      FILE *p = fopen("foo", "r");
      fclose(p);
      fclose(p); // warn: already closed
    }
    void test() {
      FILE *p = tmpfile();
      ftell(p); // warn: stream pointer might be NULL
      fclose(p);
    }
alpha.unix.cstring.BufferOverlap (C) Checks for overlap in two buffer arguments; applies to: memcpy mempcpy |
    void test() {
      int a[4] = {0};
      memcpy(a + 2, a + 1, 8); // warn
    }
alpha.unix.cstring.NotNullTerminated (C) Check for arguments which are not null-terminated strings; applies to: strlen strnlen strcpy strncpy strcat strncat |
    void test() {
      int y = strlen((char *)&test); // warn
    }
alpha.unix.cstring.OutOfBounds (C) Check for out-of-bounds access in string functions; applies to: strncopy strncat |
    void test(char *y) {
      char x[4];
      if (strlen(y) == 4)
        strncpy(x, y, 5); // warn
    }