4 ms·

I recommend `-fanalyzer` with GCC. I haven't found out how to use Clang's static analyzer. GCC now has this elaborate (kind of beautiful) way of highlighting a

I recommend `-fanalyzer` with GCC. I haven't found out how to use Clang's static analyzer. GCC now has this elaborate (kind of beautiful) way of highlighting a path through your code which leads to a potential oopsie like use after free. `-fno-omit-frame-pointer` has been useful for profiling using perf.

bmurray7jhu 3y ago
I also like using `-fanalyzer-transitivity` to force the static analyzer to treat constraints as transitive.
- bigdict 3y ago
  Can you explain what that is? This isn't included under `-fanalyzer`looks like.
  - bmurray7jhu 3y ago
    The flag applies the transitive property[1] when propagating constraints. This gives more accurate results, but at the cost of analyzer speed. if (4 < x) { if (x < y) { if (y == 0) { // Unreachable since the above three conditions cannot // all be true at the same time (without multithreading). } } } For a more detailed explanation, see [2]. (Also the inspiration for the above example.) [1] https://en.m.wikipedia.org/wiki/Transitive_relation https://en.m.wikipedia.org/wiki/Transitive_relation [2] https://github.com/gcc-mirror/gcc/commit/50ddbd0282e06614b29f0d3f3be5fbe70085a8bd https://github.com/gcc-mirror/gcc/commit/50ddbd0282e06614b29...
    - bigdict 3y ago
      I see, so you are giving it more inference power.
yaantc 3y ago
As I understand it the Clang static analyzer is not intended to be used directly. It's best to use it through CodeChecker, which provide high level commands and do the low level calls to the Clang SA (and also Clang tidy). In particular if you want whole project analysis (CTU, cross translation units analysis) CC will do the all the needed calls in a single "analyze" command. [1] https://codechecker.readthedocs.io/en/latest/ https://codechecker.readthedocs.io/en/latest/
- bigdict 3y ago
  God I love HN. It's like an office watercooler the size of a grain silo with thousands of programmers hanging around.
  - unwind 3y ago
    Now that is a tshirt design I would get behind. Or into, I guess.
- wiseowise 3y ago
  Holy crap this is amazing.
- flohofwoe 3y ago
  I currently use `--analyze -Xanalyzer -analyzer-opt-analyze-headers` for checking my header-only libs in clang, but AFAIK the recommended workflow is to use clang-tidy which is better configurable than calling clang directly. If you're on Mac with Xcode, the static analyzer and the sanitizers ASAN, UBSAN and TSAN are simple UI checkboxes.
- einpoklum 3y ago
  That codechecker thing is sooo tedios to install. Why do I need to 70 MB of environment for some python script which just wraps clang tools anyway? :-(
pabs3 3y ago
Clang's static analyzer can be run by wrapping your build with scan-build: scan-build make
- HybridCurve 3y ago
  I like scan-build better than codechecker, but codechecker is the only thing that does CTU, which is much more thorough. That being said, codechecker is not that great in terms of it's interface. Over all, it really needs to be implemented in a GUI application as there are many many fine tuning flags you can set with the clang analyzer (as well as potential for parallelization) that either cant be taken advantage of, or is too cumbersome to use codechecker to do.
  - pabs3 3y ago
    For those like me who weren't aware of CTU, it is Cross Translation Unit analysis: https://codechecker.readthedocs.io/en/latest/analyzer/user_guide/#ctu https://codechecker.readthedocs.io/en/latest/analyzer/user_g... I noticed that codechecker can also ingest results from many different tools other than Clang: https://codechecker.readthedocs.io/en/latest/supported_code_analyzers/ https://codechecker.readthedocs.io/en/latest/supported_code_...
matheusmoreira 3y ago
How do I use the sanitizers with freestanding targets? They seem to require a lot of library support which is unavailable on freestanding programs. The article mentions the address sanitizer keeps track of allocations and their sizes. I wrote my own allocator, how do I integrate it with the sanitizer? I added malloc attributes to all allocation functions but they don't seem to do anything.
- lionkor 3y ago
  yeah youd need to write some code to integrate it, i believe. I think Andreas Kling did it for SerenityOS, and has a video on it on his channel
- zyedidia 3y ago
  You need to provide implementations of the sanitizer callbacks yourself. For example, to use the address sanitizer you should use `-fsanitize=kernel-address`, and then the compiler will generate calls to `__asan_load8_noabort`, `__asan_load4_noabort`, `__asan_store8_noabort`... when loads/stores happen. In those functions, you need to implement the sanitizer yourself, and have it panic if it detects an invalid access (address sanitizers are usually implemented with shadow memory). You'll have to give your sanitizer enough shadow memory during initialization, and also add your own alloc/free sanitizer callbacks to your allocator (so the sanitizer knows when things are allocated/freed). I have an example [1] that implements a basic ASAN and UBSAN in a kernel (it's written in D, but could be easily adapted to C or C++). Hopefully it's helpful! [1]: https://github.com/zyedidia/multiplix/blob/master/kernel/sanitizer.d https://github.com/zyedidia/multiplix/blob/master/kernel/san...
- ebanorafael 3y ago
  Adding to other replies https://mcuoneclipse.com/2021/05/31/finding-memory-bugs-with-google-address-sanitizer-asan-on-microcontrollers/ https://mcuoneclipse.com/2021/05/31/finding-memory-bugs-with... https://interrupt.memfault.com/blog/ubsan-trap https://interrupt.memfault.com/blog/ubsan-trap I've tested the UBSan, it worked with some limitations but helped me catch some old hidden bugs.
pajko 3y ago
There's also a standalone command-line tool besides CodeChecker: https://clang-analyzer.llvm.org/scan-build.html https://clang-analyzer.llvm.org/scan-build.html
williamcotton 3y ago
Here’s what I’m doing: clang --analyze $(SRC_WITHOUT_SQLITE) $(shell cat compile_flags.txt | tr '\n' ' ') -I$(shell pg_config --includedir) -Xanalyzer -analyzer-output=text -Xanalyzer -analyzer-checker=core,deadcode,nullability,optin,osx,security,unix,valist -Xanalyzer -analyzer-disable-checker -Xanalyzer security.insecureAPI.DeprecatedOrUnsafeBufferHandling

bmurray7jhu 3y ago

I also like using `-fanalyzer-transitivity` to force the static analyzer to treat constraints as transitive.

bigdict 3y ago
Can you explain what that is? This isn't included under `-fanalyzer`looks like.
- bmurray7jhu 3y ago
  The flag applies the transitive property[1] when propagating constraints. This gives more accurate results, but at the cost of analyzer speed. if (4 < x) { if (x < y) { if (y == 0) { // Unreachable since the above three conditions cannot // all be true at the same time (without multithreading). } } } For a more detailed explanation, see [2]. (Also the inspiration for the above example.) [1] https://en.m.wikipedia.org/wiki/Transitive_relation https://en.m.wikipedia.org/wiki/Transitive_relation [2] https://github.com/gcc-mirror/gcc/commit/50ddbd0282e06614b29f0d3f3be5fbe70085a8bd https://github.com/gcc-mirror/gcc/commit/50ddbd0282e06614b29...
  - bigdict 3y ago
    I see, so you are giving it more inference power.

yaantc 3y ago

As I understand it the Clang static analyzer is not intended to be used directly. It's best to use it through CodeChecker, which provide high level commands and do the low level calls to the Clang SA (and also Clang tidy). In particular if you want whole project analysis (CTU, cross translation units analysis) CC will do the all the needed calls in a single "analyze" command. [1] https://codechecker.readthedocs.io/en/latest/ https://codechecker.readthedocs.io/en/latest/

bigdict 3y ago
God I love HN. It's like an office watercooler the size of a grain silo with thousands of programmers hanging around.
- unwind 3y ago
  Now that is a tshirt design I would get behind. Or into, I guess.
wiseowise 3y ago
Holy crap this is amazing.
flohofwoe 3y ago
I currently use `--analyze -Xanalyzer -analyzer-opt-analyze-headers` for checking my header-only libs in clang, but AFAIK the recommended workflow is to use clang-tidy which is better configurable than calling clang directly. If you're on Mac with Xcode, the static analyzer and the sanitizers ASAN, UBSAN and TSAN are simple UI checkboxes.
einpoklum 3y ago
That codechecker thing is sooo tedios to install. Why do I need to 70 MB of environment for some python script which just wraps clang tools anyway? :-(

pabs3 3y ago

Clang's static analyzer can be run by wrapping your build with scan-build: scan-build make

HybridCurve 3y ago
I like scan-build better than codechecker, but codechecker is the only thing that does CTU, which is much more thorough. That being said, codechecker is not that great in terms of it's interface. Over all, it really needs to be implemented in a GUI application as there are many many fine tuning flags you can set with the clang analyzer (as well as potential for parallelization) that either cant be taken advantage of, or is too cumbersome to use codechecker to do.
- pabs3 3y ago
  For those like me who weren't aware of CTU, it is Cross Translation Unit analysis: https://codechecker.readthedocs.io/en/latest/analyzer/user_guide/#ctu https://codechecker.readthedocs.io/en/latest/analyzer/user_g... I noticed that codechecker can also ingest results from many different tools other than Clang: https://codechecker.readthedocs.io/en/latest/supported_code_analyzers/ https://codechecker.readthedocs.io/en/latest/supported_code_...

matheusmoreira 3y ago

How do I use the sanitizers with freestanding targets? They seem to require a lot of library support which is unavailable on freestanding programs. The article mentions the address sanitizer keeps track of allocations and their sizes. I wrote my own allocator, how do I integrate it with the sanitizer? I added malloc attributes to all allocation functions but they don't seem to do anything.

lionkor 3y ago
yeah youd need to write some code to integrate it, i believe. I think Andreas Kling did it for SerenityOS, and has a video on it on his channel
zyedidia 3y ago
You need to provide implementations of the sanitizer callbacks yourself. For example, to use the address sanitizer you should use `-fsanitize=kernel-address`, and then the compiler will generate calls to `__asan_load8_noabort`, `__asan_load4_noabort`, `__asan_store8_noabort`... when loads/stores happen. In those functions, you need to implement the sanitizer yourself, and have it panic if it detects an invalid access (address sanitizers are usually implemented with shadow memory). You'll have to give your sanitizer enough shadow memory during initialization, and also add your own alloc/free sanitizer callbacks to your allocator (so the sanitizer knows when things are allocated/freed). I have an example [1] that implements a basic ASAN and UBSAN in a kernel (it's written in D, but could be easily adapted to C or C++). Hopefully it's helpful! [1]: https://github.com/zyedidia/multiplix/blob/master/kernel/sanitizer.d https://github.com/zyedidia/multiplix/blob/master/kernel/san...
ebanorafael 3y ago
Adding to other replies https://mcuoneclipse.com/2021/05/31/finding-memory-bugs-with-google-address-sanitizer-asan-on-microcontrollers/ https://mcuoneclipse.com/2021/05/31/finding-memory-bugs-with... https://interrupt.memfault.com/blog/ubsan-trap https://interrupt.memfault.com/blog/ubsan-trap I've tested the UBSan, it worked with some limitations but helped me catch some old hidden bugs.

pajko 3y ago

There's also a standalone command-line tool besides CodeChecker: https://clang-analyzer.llvm.org/scan-build.html https://clang-analyzer.llvm.org/scan-build.html

williamcotton 3y ago

Here’s what I’m doing: clang --analyze $(SRC_WITHOUT_SQLITE) $(shell cat compile_flags.txt | tr '\n' ' ') -I$(shell pg_config --includedir) -Xanalyzer -analyzer-output=text -Xanalyzer -analyzer-checker=core,deadcode,nullability,optin,osx,security,unix,valist -Xanalyzer -analyzer-disable-checker -Xanalyzer security.insecureAPI.DeprecatedOrUnsafeBufferHandling