2 Commits

Author SHA1 Message Date
Endre Fülöp
b98a594977
[clang][analyzer] Move security.cert.env.InvalidPtr out of alpha (#71912)
Thanks to recent improvements in #67663, InvalidPtr checker does not
emit any false positives on the following OS projects: memcached, tmux,
curl, twin, vim, openssl, sqlite, ffmpeg, postgres, tinyxml2, libwebm,
xerces, bitcoin, protobuf, qtbase, contour, acid, openrct2. (Before the
changes mentioned above, there were 27 reports, catching the `getenv`
invalidates previous `getenv` results cases. That strict behaviour is
disabled by default)
2023-11-24 10:02:56 +01:00
Endre Fülöp
f7a46d700f
[analyzer][clangsa] Add new option to alpha.security.cert.InvalidPtrChecker (#67663)
Introduce 'InvalidatingGetEnv' checker option for 'getenv' calls.

- POSIX suggests consecutive 'getenv' calls may invalidate 
  pointer pointers. This is often too strict in real-world scenarios.
- New 'InvalidatingGetEnv' checker option provides a more 
  pragmatic default that doesn't treat consecutive 'getenv' 
  calls as invalidating.
- Now also handles main function specifications with an 
  environment pointer as the third parameter.

Original Phabricator review:
https://reviews.llvm.org/D154603
2023-10-24 13:59:54 +02:00