https://github.com/benedekaibas updated https://github.com/llvm/llvm-project/pull/216688
>From bd3d24461879a728a3b1b245181f6d0271349044 Mon Sep 17 00:00:00 2001 From: benedekaibas <[email protected]> Date: Mon, 17 Aug 2026 12:28:23 +0200 Subject: [PATCH 1/2] [analyzer][docs] Add documentation for the DanglingPtrDeref checker --- clang/docs/analyzer/checkers.rst | 55 +++++++++++++++++++ .../clang/StaticAnalyzer/Checkers/Checkers.td | 20 +++---- clang/test/Analysis/dangling-ptr-deref.cpp | 2 +- 3 files changed, 66 insertions(+), 11 deletions(-) diff --git a/clang/docs/analyzer/checkers.rst b/clang/docs/analyzer/checkers.rst index 1f6b974d5ca7a..5d43579a09eb6 100644 --- a/clang/docs/analyzer/checkers.rst +++ b/clang/docs/analyzer/checkers.rst @@ -3248,6 +3248,61 @@ Loss of sign/precision in implicit conversions. short X = A; // warn (loss of precision) } +.. _alpha-core-DanglingPtrDeref: + +alpha.core.DanglingPtrDeref (C, C++) +"""""""""""""""""""""""""""""""""""" +Check for dereferences of pointers that refer to an object whose +lifetime has already ended. Such a pointer is dangling. The checker +reports it when it is dereferenced and when it is passed to a function. + +Each object is reported at most once on an execution path. If the same dangling +pointer is used several times then only the first use is reported. + +.. code-block:: cpp + + void test_deref() { + int *ptr = 0; + { + int num = 5; + ptr = # + } // note: 'num' is destroyed here + *ptr = 6; // warn: use of 'num' after its lifetime ended + } + + void test_in_scope() { + int num = 5; + int *ptr = # + { + *ptr = 6; // no warning, 'num' is still in scope + } + } + +The checker requires end-of-lifetime information from the CFG. It is enabled +with the ``-analyzer-config cfg-lifetime=true`` option. + +**Limitations** + +If the analyzer does not inline the called function, for example because its +definition is not available in the given translation unit, then a dangling +pointer passed to it is reported even if the function would never dereference +it. This can lead to false positives. + +.. code-block:: cpp + + // The definition of the function is not available that is why the analyzer + // assumes the pointer is used. + int is_null(int *p); + + void argument_example() { + int *ptr = 0; + { + int num = 5; + ptr = # + } + is_null(ptr); // false positive: the pointer is compared, not dereferenced + } + .. _alpha-core-DynamicTypeChecker: alpha.core.DynamicTypeChecker (ObjC) diff --git a/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td b/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td index b6b3857dc7b35..3e6e7c9ea13d5 100644 --- a/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td +++ b/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td @@ -289,6 +289,16 @@ def StdVariantChecker : Checker<"StdVariant">, HelpText<"Check for bad type access for std::variant.">, Documentation<HasDocumentation>; +def LifetimeModeling : Checker<"LifetimeModeling">, + HelpText<"Model lifetime annotations for other checkers">, + Documentation<NotDocumented>, + Hidden; + +def DanglingPtrDeref : Checker<"DanglingPtrDeref">, + HelpText<"Check for dereferences of a dangling pointer">, + Dependencies<[LifetimeModeling]>, + Documentation<HasDocumentation>; + } // end "alpha.core" //===----------------------------------------------------------------------===// @@ -802,22 +812,12 @@ def SmartPtrChecker: Checker<"SmartPtr">, Dependencies<[SmartPtrModeling]>, Documentation<HasDocumentation>; -def LifetimeModeling : Checker<"LifetimeModeling">, - HelpText<"Model lifetime annotations for other checkers">, - Documentation<NotDocumented>, - Hidden; - def UseAfterLifetimeEnd : Checker<"UseAfterLifetimeEnd">, HelpText<"Check for uses of references or pointers that " "outlive their bound object">, Dependencies<[LifetimeModeling]>, Documentation<NotDocumented>; -def DanglingPtrDeref : Checker<"DanglingPtrDeref">, - HelpText<"Check for dereferences of a dangling pointer">, - Dependencies<[LifetimeModeling]>, - Documentation<NotDocumented>; - } // end: "alpha.cplusplus" //===----------------------------------------------------------------------===// diff --git a/clang/test/Analysis/dangling-ptr-deref.cpp b/clang/test/Analysis/dangling-ptr-deref.cpp index 55dd5eadc8ad0..8572b6416f150 100644 --- a/clang/test/Analysis/dangling-ptr-deref.cpp +++ b/clang/test/Analysis/dangling-ptr-deref.cpp @@ -1,4 +1,4 @@ -// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.cplusplus.DanglingPtrDeref \ +// RUN: %clang_analyze_cc1 -analyzer-checker=core,alpha.core.DanglingPtrDeref \ // RUN: -analyzer-config cfg-lifetime=true -analyzer-output=text -verify %s void test_case_one() { >From 0ad17fcca72501a55332c566cf57524bf079f96c Mon Sep 17 00:00:00 2001 From: benedekaibas <[email protected]> Date: Mon, 17 Aug 2026 15:05:13 +0200 Subject: [PATCH 2/2] Revert move to alpha.core. --- .../clang/StaticAnalyzer/Checkers/Checkers.td | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td b/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td index 3e6e7c9ea13d5..b1b87dc883ed6 100644 --- a/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td +++ b/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td @@ -289,16 +289,6 @@ def StdVariantChecker : Checker<"StdVariant">, HelpText<"Check for bad type access for std::variant.">, Documentation<HasDocumentation>; -def LifetimeModeling : Checker<"LifetimeModeling">, - HelpText<"Model lifetime annotations for other checkers">, - Documentation<NotDocumented>, - Hidden; - -def DanglingPtrDeref : Checker<"DanglingPtrDeref">, - HelpText<"Check for dereferences of a dangling pointer">, - Dependencies<[LifetimeModeling]>, - Documentation<HasDocumentation>; - } // end "alpha.core" //===----------------------------------------------------------------------===// @@ -812,12 +802,22 @@ def SmartPtrChecker: Checker<"SmartPtr">, Dependencies<[SmartPtrModeling]>, Documentation<HasDocumentation>; +def LifetimeModeling : Checker<"LifetimeModeling">, + HelpText<"Model lifetime annotations for other checkers">, + Documentation<NotDocumented>, + Hidden; + def UseAfterLifetimeEnd : Checker<"UseAfterLifetimeEnd">, HelpText<"Check for uses of references or pointers that " "outlive their bound object">, Dependencies<[LifetimeModeling]>, Documentation<NotDocumented>; +def DanglingPtrDeref : Checker<"DanglingPtrDeref">, + HelpText<"Check for dereferences of a dangling pointer">, + Dependencies<[LifetimeModeling]>, + Documentation<HasDocumentation>; + } // end: "alpha.cplusplus" //===----------------------------------------------------------------------===// _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
