2009-06-09 01:21:24 +04:00
|
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
|
|
|
|
|
"http://www.w3.org/TR/html4/strict.dtd">
|
|
|
|
|
<html>
|
|
|
|
|
<head>
|
|
|
|
|
<title>Clang Static Analyzer</title>
|
2010-02-10 00:48:04 +03:00
|
|
|
<link type="text/css" rel="stylesheet" href="content.css" />
|
|
|
|
|
<link type="text/css" rel="stylesheet" href="menu.css" />
|
|
|
|
|
<link type="text/javascript" rel="javascript" href="menu.js"/>
|
2009-06-09 01:21:24 +04:00
|
|
|
</head>
|
|
|
|
|
<body>
|
|
|
|
|
|
|
|
|
|
<!--#include virtual="menu.html.incl"-->
|
|
|
|
|
|
|
|
|
|
<div id="content">
|
2010-02-10 00:48:04 +03:00
|
|
|
<table style="margin-top:0px" border="0" cellpadding="0" cellspacing="0">
|
2010-02-09 02:50:54 +03:00
|
|
|
<tr><td>
|
|
|
|
|
<h1>Clang Static Analyzer</h1>
|
2009-06-09 01:21:24 +04:00
|
|
|
<p>The Clang Static Analyzer consists of both a source code analysis framework
|
|
|
|
|
and a standalone tool that finds bugs in C and Objective-C programs. The
|
|
|
|
|
standalone tool is invoked from the command-line, and is intended to run in
|
|
|
|
|
tandem with a build of a project or code base.</p>
|
|
|
|
|
|
|
|
|
|
<p>Both are 100% open source and are part of the <a
|
|
|
|
|
href="http://clang.llvm.org">Clang</a> project.</p>
|
2010-02-09 01:12:48 +03:00
|
|
|
|
2009-06-09 01:21:24 +04:00
|
|
|
<!-- Generated from: http://www.spiffycorners.com/index.php -->
|
|
|
|
|
|
|
|
|
|
<style type="text/css">
|
|
|
|
|
.spiffy{display:block}
|
|
|
|
|
.spiffy *{
|
|
|
|
|
display:block;
|
|
|
|
|
height:1px;
|
|
|
|
|
overflow:hidden;
|
|
|
|
|
font-size:.01em;
|
|
|
|
|
background:#EBF0FA}
|
|
|
|
|
.spiffy1{
|
|
|
|
|
margin-left:3px;
|
|
|
|
|
margin-right:3px;
|
|
|
|
|
padding-left:1px;
|
|
|
|
|
padding-right:1px;
|
|
|
|
|
border-left:1px solid #f6f8fc;
|
|
|
|
|
border-right:1px solid #f6f8fc;
|
|
|
|
|
background:#f0f3fb}
|
|
|
|
|
.spiffy2{
|
|
|
|
|
margin-left:1px;
|
|
|
|
|
margin-right:1px;
|
|
|
|
|
padding-right:1px;
|
|
|
|
|
padding-left:1px;
|
|
|
|
|
border-left:1px solid #fdfdfe;
|
|
|
|
|
border-right:1px solid #fdfdfe;
|
|
|
|
|
background:#eef2fa}
|
|
|
|
|
.spiffy3{
|
|
|
|
|
margin-left:1px;
|
|
|
|
|
margin-right:1px;
|
|
|
|
|
border-left:1px solid #eef2fa;
|
|
|
|
|
border-right:1px solid #eef2fa;}
|
|
|
|
|
.spiffy4{
|
|
|
|
|
border-left:1px solid #f6f8fc;
|
|
|
|
|
border-right:1px solid #f6f8fc}
|
|
|
|
|
.spiffy5{
|
|
|
|
|
border-left:1px solid #f0f3fb;
|
|
|
|
|
border-right:1px solid #f0f3fb}
|
|
|
|
|
.spiffyfg{
|
|
|
|
|
background:#EBF0FA}
|
|
|
|
|
|
|
|
|
|
.spiffyfg h2 {
|
|
|
|
|
margin:0px; padding:10px;
|
|
|
|
|
}
|
|
|
|
|
</style>
|
|
|
|
|
|
|
|
|
|
<style type="text/css">
|
|
|
|
|
#left { float:left; }
|
|
|
|
|
#left h2 { margin:1px; padding-top:0px; }
|
|
|
|
|
#right { float:left; margin-left:20px; margin-right:20px; padding:0px ;}
|
|
|
|
|
#right h2 { padding:0px; margin:0px; }
|
|
|
|
|
#wrappedcontent { padding:15px;}
|
|
|
|
|
</style>
|
|
|
|
|
|
2010-02-09 02:50:54 +03:00
|
|
|
<div style="margin-left:25px; margin-right:25px; padding:0px; font-size: 80%">
|
2009-06-09 01:21:24 +04:00
|
|
|
<b class="spiffy">
|
|
|
|
|
<b class="spiffy1"><b></b></b>
|
|
|
|
|
<b class="spiffy2"><b></b></b>
|
|
|
|
|
<b class="spiffy3"></b>
|
|
|
|
|
<b class="spiffy4"></b>
|
|
|
|
|
<b class="spiffy5"></b></b>
|
|
|
|
|
<div class="spiffyfg">
|
|
|
|
|
<div style="padding:15px">
|
|
|
|
|
<h2 style="padding:0px; margin:0px">Download</h2>
|
|
|
|
|
<h3 style="margin-top:5px">Mac OS X</h3>
|
|
|
|
|
<ul>
|
|
|
|
|
<li>Latest build (Universal binary, 10.5+):
|
|
|
|
|
<!--#include virtual="latest_checker.html.incl"-->
|
|
|
|
|
</li>
|
|
|
|
|
<li><a href="/installation.html">Installation</a> and <a
|
|
|
|
|
href="/scan-build.html">usage</a></li>
|
|
|
|
|
</ul>
|
|
|
|
|
<h3>Other Platforms</h3>
|
|
|
|
|
<p>For other platforms, please follow the instructions for <a
|
|
|
|
|
href="/installation#OtherPlatforms">building the analyzer</a> from
|
|
|
|
|
source code.<p>
|
|
|
|
|
</div>
|
|
|
|
|
</div>
|
|
|
|
|
<b class="spiffy">
|
|
|
|
|
<b class="spiffy5"></b>
|
|
|
|
|
<b class="spiffy4"></b>
|
|
|
|
|
<b class="spiffy3"></b>
|
|
|
|
|
<b class="spiffy2"><b></b></b>
|
|
|
|
|
<b class="spiffy1"><b></b></b></b>
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<h2 id="StaticAnalysis">What is Static Analysis?</h2>
|
|
|
|
|
|
|
|
|
|
<p>The term "static analysis" is conflated, but here we use it to mean
|
|
|
|
|
a collection of algorithms and techniques used to analyze source code in order
|
|
|
|
|
to automatically find bugs. The idea is similar in spirit to compiler warnings
|
|
|
|
|
(which can be useful for finding coding errors) but to take that idea a step
|
|
|
|
|
further and find bugs that are traditionally found using run-time debugging
|
|
|
|
|
techniques such as testing.</p>
|
|
|
|
|
|
|
|
|
|
<p>Static analysis bug-finding tools have evolved over the last several decades
|
|
|
|
|
from basic syntactic checkers to those that find deep bugs by reasoning about
|
|
|
|
|
the semantics of code. The goal of the Clang Static Analyzer is to provide a
|
|
|
|
|
industrial-quality static analysis framework for analyzing C and Objective-C
|
|
|
|
|
programs that is freely available, extensible, and has a high quality of
|
|
|
|
|
implementation.</p>
|
|
|
|
|
|
2010-02-09 02:50:54 +03:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</td><td>
|
|
|
|
|
<a href="images/analyzer_xcode.png"><img src="images/analyzer_xcode.png" width="450x"></a>
|
|
|
|
|
<center><b>Viewing static analyzer results in Xcode 3.2</b></center>
|
|
|
|
|
<a href="images/analyzer_html.png"><img src="images/analyzer_html.png" width="450px"></a>
|
2010-02-09 02:57:20 +03:00
|
|
|
<center><b>Viewing static analyzer results in a web browser</b></center>
|
2010-02-09 02:50:54 +03:00
|
|
|
</td></tr></table>
|
|
|
|
|
|
2009-06-09 01:21:24 +04:00
|
|
|
<h3 id="Clang">Part of Clang and LLVM</h3>
|
|
|
|
|
|
|
|
|
|
<p>As its name implies, the Clang Static Analyzer is built on top of <a
|
|
|
|
|
href="http://clang.llvm.org">Clang</a> and <a href="http://llvm.org">LLVM</a>.
|
|
|
|
|
Strictly speaking, the analyzer is part of Clang, as Clang consists of a set of
|
|
|
|
|
reusable C++ libraries for building powerful source-level tools. The static
|
|
|
|
|
analysis engine used by the Clang Static Analyzer is a Clang library, and has
|
|
|
|
|
the capability to be reused in different contexts and by different clients.</p>
|
|
|
|
|
|
|
|
|
|
<h2>Important Points to Consider</h2>
|
|
|
|
|
|
|
|
|
|
<p>While we believe that the static analyzer is already very useful for finding
|
|
|
|
|
bugs, we ask you to bear in mind a few points when using it.</p>
|
|
|
|
|
|
|
|
|
|
<h3>Work-in-Progress</h3>
|
|
|
|
|
|
|
|
|
|
<p>The analyzer is a continuous work-in-progress.
|
|
|
|
|
There are many planned enhancements to improve both the precision and scope of
|
|
|
|
|
its analysis algorithms as well as the kinds bugs it will find. While there are
|
|
|
|
|
fundamental limitations to what static analysis can do, we have a long way to go
|
|
|
|
|
before hitting that wall.</p>
|
|
|
|
|
|
|
|
|
|
<h3>Slower than Compilation</h3>
|
|
|
|
|
|
|
|
|
|
<p>Operationally, using static analysis to
|
|
|
|
|
automatically find deep program bugs is about trading CPU time for the hardening
|
|
|
|
|
of code. Because of the deep analysis performed by state-of-the-art static
|
|
|
|
|
analysis tools, static analysis can be much slower than compilation.</p>
|
|
|
|
|
|
|
|
|
|
<p>While the Clang Static Analyzer is being designed to be as fast and
|
|
|
|
|
light-weight as possible, please do not expect it to be as fast as compiling a
|
|
|
|
|
program (even with optimizations enabled). Some of the algorithms needed to find
|
|
|
|
|
bugs require in the worst case exponential time.</p>
|
|
|
|
|
|
|
|
|
|
<p>The Clang Static Analyzer runs in a reasonable amount of time by both
|
|
|
|
|
bounding the amount of checking work it will do as well as using clever
|
|
|
|
|
algorithms to reduce the amount of work it must do to find bugs.</p></li>
|
|
|
|
|
|
|
|
|
|
<h3>False Positives</h3>
|
|
|
|
|
|
|
|
|
|
<p>Static analysis is not perfect. It can falsely flag bugs in a program where
|
|
|
|
|
the code behaves correctly. Because some code checks require more analysis
|
|
|
|
|
precision than others, the frequency of false positives can vary widely between
|
|
|
|
|
different checks. Our long-term goal is to have the analyzer have a low false
|
|
|
|
|
positive rate for most code on all checks.</p>
|
|
|
|
|
|
|
|
|
|
<p>Please help us in this endeavor by <a href="filing_bugs.html">reporting false
|
|
|
|
|
positives</a>. False positives cannot be addressed unless we know about
|
|
|
|
|
them.</p>
|
|
|
|
|
|
|
|
|
|
<h3>More Checks</h3>
|
|
|
|
|
|
2009-06-15 17:22:32 +04:00
|
|
|
<p>Static analysis is not magic; a static analyzer can only find bugs that it
|
|
|
|
|
has been specifically engineered to find. If there are specific kinds of bugs
|
|
|
|
|
you would like the Clang Static Analyzer to find, please feel free to
|
|
|
|
|
file <a href="filing_bugs.html">feature requests</a> or contribute your own
|
|
|
|
|
patches.</p>
|
2009-06-09 01:21:24 +04:00
|
|
|
|
|
|
|
|
</div>
|
|
|
|
|
</body>
|
|
|
|
|
</html>
|
|
|
|
|
|
