Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
61 commits
Select commit Hold shift + click to select a range
cb8c65a
Reapply "[clang][ssaf] Add UnsafeBufferUsage summary extractor for fu…
ziqingluo-90 Mar 12, 2026
09fcf76
[ssaf][UnsafeBufferUsage] Add support for extracting unsafe pointers …
ziqingluo-90 Mar 5, 2026
613955c
clean up
ziqingluo-90 Mar 5, 2026
deef1a0
Address comments
ziqingluo-90 Mar 17, 2026
5ffde95
Reapply "[clang][ssaf] Add UnsafeBufferUsage summary extractor for fu…
ziqingluo-90 Mar 12, 2026
fe7dd28
[ssaf][UnsafeBufferUsage] Add support for extracting unsafe pointers …
ziqingluo-90 Mar 5, 2026
ebd6232
clean up
ziqingluo-90 Mar 5, 2026
e26fd17
Address comments
ziqingluo-90 Mar 17, 2026
9a21205
[ssaf][UnsafeBufferUsage] Add JSON serialization for UnsafeBufferUsage
ziqingluo-90 Mar 10, 2026
1bf9a44
Merge branch 'main' into users/ziqingluo/eng/PR-171735836
ziqingluo-90 Mar 17, 2026
8e063bd
fix a conflict merge issue
ziqingluo-90 Mar 17, 2026
9a4630d
Fix clang-format issue
ziqingluo-90 Mar 17, 2026
5e855a9
Merge branch 'users/ziqingluo/eng/PR-171735836' into users/ziqingluo/…
ziqingluo-90 Mar 17, 2026
50ab079
[NFC][SSAF][UnsafeBufferUsage] Separate EntityPointerLevel and Unsafe…
ziqingluo-90 Mar 25, 2026
5e83028
[SSAF][UnsafeBufferUsage] Implement AST visitor that respects the con…
ziqingluo-90 Mar 25, 2026
620d322
Merge remote-tracking branch 'origin' into users/ziqingluo/eng/PR-171…
ziqingluo-90 Mar 26, 2026
e5dbc48
address some comments
ziqingluo-90 Mar 26, 2026
2cbbc1a
address comments
ziqingluo-90 Mar 26, 2026
8420612
Update clang/lib/ScalableStaticAnalysisFramework/Analyses/UnsafeBuffe…
ziqingluo-90 Mar 27, 2026
f8a2e0e
Update clang/lib/ScalableStaticAnalysisFramework/Analyses/UnsafeBuffe…
ziqingluo-90 Mar 27, 2026
354f742
Update clang/lib/ScalableStaticAnalysisFramework/Analyses/UnsafeBuffe…
ziqingluo-90 Mar 27, 2026
157f3c2
refactor UnsafeBufferUsage serialization API and test for Format inde…
ziqingluo-90 Mar 29, 2026
0e7f715
address comments
ziqingluo-90 Mar 30, 2026
e4d0b9e
address comments
ziqingluo-90 Apr 1, 2026
4d8f738
Merge branch 'main' into users/ziqingluo/eng/PR-171920065
ziqingluo-90 Apr 1, 2026
54e480e
address comments
ziqingluo-90 Apr 1, 2026
68eddbb
Update clang/include/clang/ScalableStaticAnalysisFramework/Analyses/U…
ziqingluo-90 Apr 2, 2026
70c1962
Update clang/include/clang/ScalableStaticAnalysisFramework/Analyses/U…
ziqingluo-90 Apr 2, 2026
1b980e0
Update clang/include/clang/ScalableStaticAnalysisFramework/Analyses/U…
ziqingluo-90 Apr 2, 2026
b220e30
Update clang/include/clang/ScalableStaticAnalysisFramework/Analyses/U…
ziqingluo-90 Apr 2, 2026
9eebb20
Update clang/include/clang/ScalableStaticAnalysisFramework/Analyses/U…
ziqingluo-90 Apr 2, 2026
74863f2
Update clang/include/clang/ScalableStaticAnalysisFramework/Analyses/U…
ziqingluo-90 Apr 2, 2026
ce07c3c
Update clang/unittests/ScalableStaticAnalysisFramework/Analyses/Unsaf…
ziqingluo-90 Apr 2, 2026
d30f0f5
Merge remote-tracking branch 'origin/main' into users/ziqingluo/eng/P…
ziqingluo-90 Apr 2, 2026
0a1c297
Merge branch 'main' into users/ziqingluo/eng/PR-171920065
ziqingluo-90 Apr 2, 2026
b44a110
[NFC][SSAF][UnsafeBufferUsage] Separate EntityPointerLevel and Unsafe…
ziqingluo-90 Apr 2, 2026
f3c29ee
rebase
ziqingluo-90 Apr 2, 2026
1cf2c6a
clean up
ziqingluo-90 Apr 2, 2026
a71bb3b
Merge remote-tracking branch 'origin/users/ziqingluo/PR-172429193' in…
ziqingluo-90 Apr 2, 2026
4c681ab
fix issues after rebase
ziqingluo-90 Apr 2, 2026
036f9b1
remove proxy functions for unit-testing UnsafeBufferUsageExtractor
ziqingluo-90 Apr 5, 2026
1a7d533
fix clang-format issue
ziqingluo-90 Apr 5, 2026
ae57606
fix build issue
ziqingluo-90 Apr 6, 2026
8e54890
fix bugs
ziqingluo-90 Apr 6, 2026
abc7647
fix typo
ziqingluo-90 Apr 6, 2026
63be9b2
fix format
ziqingluo-90 Apr 7, 2026
c3a6643
Update clang/include/clang/ScalableStaticAnalysisFramework/Analyses/E…
ziqingluo-90 Apr 9, 2026
4eec9ca
Update clang/lib/ScalableStaticAnalysisFramework/Analyses/SSAFAnalyse…
ziqingluo-90 Apr 9, 2026
58d8ee8
address comments
ziqingluo-90 Apr 9, 2026
a4ccace
[NFC][SSAF] Move EntityPointerLevel to a separate folder
ziqingluo-90 Apr 10, 2026
3994ca4
[SSAF][UnsafeBufferUsage] Add APIs to the EntityPointerLevel module f…
ziqingluo-90 Apr 10, 2026
11bc5e0
Update clang/lib/ScalableStaticAnalysisFramework/Analyses/EntityPoint…
ziqingluo-90 Apr 13, 2026
3b4bddf
Update clang/include/clang/ScalableStaticAnalysisFramework/Analyses/E…
ziqingluo-90 Apr 13, 2026
ab91945
Update clang/include/clang/ScalableStaticAnalysisFramework/Analyses/E…
ziqingluo-90 Apr 13, 2026
d44fad7
address comments
ziqingluo-90 Apr 13, 2026
0b8f8e7
Merge branch 'main' into users/ziqingluo/PR-172429193-pre-2
ziqingluo-90 Apr 13, 2026
39fbbba
fix format
ziqingluo-90 Apr 13, 2026
5bfbef7
Update clang/lib/ScalableStaticAnalysisFramework/Analyses/SSAFAnalyse…
ziqingluo-90 Apr 13, 2026
1f11604
Merge remote-tracking branch 'origin/users/ziqingluo/PR-172429193-pre…
ziqingluo-90 Apr 13, 2026
7883cc3
fix issues after merging
ziqingluo-90 Apr 13, 2026
2d70920
Merge branch 'users/ziqingluo/PR-172429193-2' of github.com:llvm/llvm…
ziqingluo-90 Apr 13, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 4 additions & 8 deletions clang/include/clang/Analysis/Analyses/UnsafeBufferUsage.h
Original file line number Diff line number Diff line change
Expand Up @@ -201,14 +201,10 @@ bool anyConflict(const llvm::SmallVectorImpl<FixItHint> &FixIts,
const SourceManager &SM);
} // namespace internal

/// Find unsafe pointers in body/initializer of `D`, if `D` is one of the
/// followings:
/// VarDecl
/// FieldDecl
/// FunctionDecl
/// BlockDecl
/// ObjCMethodDecl
std::set<const Expr *> findUnsafePointers(const Decl *D);
/// \return true iff `N` is an unsafe buffer usage and populates the unsafe
/// pointers in `UnsafePointers`
bool matchUnsafePointers(const DynTypedNode &N, ASTContext &Ctx,
std::set<const Expr *> &UnsafePointers);
} // end namespace clang

#endif /* LLVM_CLANG_ANALYSIS_ANALYSES_UNSAFEBUFFERUSAGE_H */
Original file line number Diff line number Diff line change
@@ -0,0 +1,134 @@
//===- EntityPointerLevel.h -------------------------------------*- C++ -*-===//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//

#ifndef LLVM_CLANG_SCALABLESTATICANALYSISFRAMEWORK_ANALYSES_ENTITYPOINTERLEVEL_H
#define LLVM_CLANG_SCALABLESTATICANALYSISFRAMEWORK_ANALYSES_ENTITYPOINTERLEVEL_H

#include "clang/AST/Decl.h"
#include "clang/ScalableStaticAnalysisFramework/Core/Model/EntityId.h"
#include "clang/ScalableStaticAnalysisFramework/Core/Serialization/JSONFormat.h"
#include <set>

namespace clang::ssaf {

/// An EntityPointerLevel is associated with a level of the declared
/// pointer/array type of an entity. In the fully-expanded spelling of the
/// declared type, a EntityPointerLevel is associated with a '*' (or a '[]`) in
/// that declaration.
///
/// For example, for 'int *p[10];', there are two EntityPointerLevels. One
/// is associated with 'int *[10]' of 'p' and the other is associated with 'int
/// *' of 'p'.
Comment thread
ziqingluo-90 marked this conversation as resolved.
///
/// An EntityPointerLevel can be identified by an EntityId and an unsigned
/// integer indicating the pointer level: '(EntityId, PointerLevel)'.
/// An EntityPointerLevel 'P' is valid iff 'P.EntityId' has a pointer type with
/// at least 'P.PointerLevel' levels (This implies 'P.PointerLevel > 0').
///
/// For the same example 'int *p[10];', the EntityPointerLevels below are valid:
/// - '(p, 2)' is associated with the 'int *' part of the declared type of 'p';
/// - '(p, 1)' is associated with the 'int *[10]' part of the declared type of
/// 'p'.
Comment thread
ziqingluo-90 marked this conversation as resolved.
class EntityPointerLevel {
Comment thread
steakhal marked this conversation as resolved.
EntityId Entity;
unsigned PointerLevel;

friend class EntityPointerLevelTranslator;
friend llvm::Expected<EntityPointerLevel>
entityPointerLevelFromJSON(const llvm::json::Value &EPLData,
JSONFormat::EntityIdFromJSONFn EntityIdFromJSON);
// For unittests:
friend EntityPointerLevel buildEntityPointerLevel(EntityId, unsigned);

// EntityPointerLevel(EntityId Entity, unsigned PointerLevel)
// : Entity(Entity), PointerLevel(PointerLevel) {}
Comment thread
ziqingluo-90 marked this conversation as resolved.
EntityPointerLevel(std::pair<EntityId, unsigned> Pair)
: Entity(Pair.first), PointerLevel(Pair.second) {}

public:
EntityId getEntity() const { return Entity; }
unsigned getPointerLevel() const { return PointerLevel; }

bool operator==(const EntityPointerLevel &Other) const {
return std::tie(Entity, PointerLevel) ==
std::tie(Other.Entity, Other.PointerLevel);
}

bool operator!=(const EntityPointerLevel &Other) const {
return !(*this == Other);
}

bool operator<(const EntityPointerLevel &Other) const {
return std::tie(Entity, PointerLevel) <
std::tie(Other.Entity, Other.PointerLevel);
}

/// Compares `EntityPointerLevel`s; additionally, partially compares
/// `EntityPointerLevel` with `EntityId`.
struct Comparator {
using is_transparent = void;
bool operator()(const EntityPointerLevel &L,
const EntityPointerLevel &R) const {
return L < R;
}
bool operator()(const EntityId &L, const EntityPointerLevel &R) const {
return L < R.getEntity();
}
bool operator()(const EntityPointerLevel &L, const EntityId &R) const {
return L.getEntity() < R;
}
};
};

using EntityPointerLevelSet =
std::set<EntityPointerLevel, EntityPointerLevel::Comparator>;

/// Translate a pointer/array type expression 'E' to a (set of)
/// EntityPointerLevel(s) associated with the declared type of the base address
/// of `E`. If the base address of `E` is not associated with an entity, the
/// translation result is an empty set.
///
/// \param E the pointer expression to be translated
/// \param Ctx the AST context of `E`
/// \param AddEntity the callback provided by the caller to convert EntityNames
/// to EntityIds.
llvm::Expected<EntityPointerLevelSet>
translateEntityPointerLevel(const Expr *E, ASTContext &Ctx,
std::function<EntityId(EntityName EN)> AddEntity);

/// Create an EntityPointerLevel (EPL) from a NamedDecl of a pointer/array type.
///
/// \param E the pointer expression to be translated
/// \param Ctx the AST context of `E`
/// \param AddEntity the callback provided by the caller to convert EntityNames
/// to EntityIds.
/// \param IsFunRet true iff the created EPL is associated with the return type
/// of a function entity.
llvm::Expected<EntityPointerLevel>
createEntityPointerLevel(const NamedDecl *ND, ASTContext &Ctx,
std::function<EntityId(EntityName EN)> AddEntity,
bool IsFunRet = false);

/// Creates a new EntityPointerLevel (EPL) from `E` by incrementing `E`'s
/// pointer level.
/// \return the EPL that is associated with the pointee (or array element) type
/// of `E`'s associated pointer/array tyoe of the same entity.
EntityPointerLevel incrementPointerLevel(const EntityPointerLevel &E);

llvm::json::Value
entityPointerLevelToJSON(const EntityPointerLevel &EPL,
JSONFormat::EntityIdToJSONFn EntityId2JSON);

llvm::Expected<EntityPointerLevel>
entityPointerLevelFromJSON(const llvm::json::Value &EPLData,
JSONFormat::EntityIdFromJSONFn EntityIdFromJSON);

/// Proxy function creating EPLs for unit tests:
EntityPointerLevel buildEntityPointerLevel(EntityId, unsigned);
} // namespace clang::ssaf
#endif // LLVM_CLANG_SCALABLESTATICANALYSISFRAMEWORK_ANALYSES_ENTITYPOINTERLEVEL_H
Original file line number Diff line number Diff line change
Expand Up @@ -12,17 +12,19 @@
#include "clang/AST/Expr.h"
#include "clang/ScalableStaticAnalysisFramework/Core/Model/EntityId.h"
#include "clang/ScalableStaticAnalysisFramework/Core/Model/EntityName.h"
#include "llvm/ADT/STLFunctionalExtras.h"
#include <set>

namespace clang::ssaf {

/// An EntityPointerLevel represents a level of the declared pointer/array
/// type of an entity. In the fully-expanded spelling of the declared type, a
/// EntityPointerLevel is associated with a '*' (or a '[]`) in that declaration.
/// An EntityPointerLevel is associated with a level of the declared
/// pointer/array type of an entity. In the fully-expanded spelling of the
/// declared type, a EntityPointerLevel is associated with a '*' (or a '[]`) in
/// that declaration.
///
/// For example, for 'int *p[10];', there are two EntityPointerLevels. One
/// is associated with 'int *[10]' of 'p' and the other is associated with 'int
/// *' of 'p'.
/// For example, for 'int *p[10];', there are two EntityPointerLevels.
/// One is associated with 'int *[10]' of 'p' and the other is associated with
/// 'int *' of 'p'.
///
/// An EntityPointerLevel can be identified by an EntityId and an unsigned
/// integer indicating the pointer level: '(EntityId, PointerLevel)'.
Expand All @@ -32,16 +34,17 @@ namespace clang::ssaf {
/// For the same example 'int *p[10];', the EntityPointerLevels below are valid:
/// - '(p, 2)' is associated with the 'int *' part of the declared type of 'p';
/// - '(p, 1)' is associated with the 'int *[10]' part of the declared type of
/// 'p'.
/// 'p'.
class EntityPointerLevel {
EntityId Entity;
unsigned PointerLevel;

friend class EntityPointerLevelTranslator;
// For unittests:
friend EntityPointerLevel buildEntityPointerLevel(EntityId, unsigned);

EntityPointerLevel(EntityId Entity, unsigned PointerLevel)
: Entity(Entity), PointerLevel(PointerLevel) {}
EntityPointerLevel(std::pair<EntityId, unsigned> Pair)
: Entity(Pair.first), PointerLevel(Pair.second) {}

public:
EntityId getEntity() const { return Entity; }
Expand Down Expand Up @@ -90,10 +93,31 @@ using EntityPointerLevelSet =
/// \param Ctx the AST context of `E`
/// \param AddEntity the callback provided by the caller to convert EntityNames
/// to EntityIds.
llvm::Expected<EntityPointerLevelSet>
translateEntityPointerLevel(const Expr *E, ASTContext &Ctx,
std::function<EntityId(EntityName EN)> AddEntity);
llvm::Expected<EntityPointerLevelSet> translateEntityPointerLevel(
const Expr *E, ASTContext &Ctx,
llvm::function_ref<EntityId(EntityName EN)> AddEntity);

/// Creates a `EntityPointerLevel` from a pair of an EntityId and a pointer
/// level:
EntityPointerLevel buildEntityPointerLevel(EntityId, unsigned);

/// Create an EntityPointerLevel (EPL) from a NamedDecl of a pointer/array type.
///
/// \param ND the NamedDecl of a pointer/array type.
/// \param AddEntity the callback provided by the caller to convert EntityNames
/// to EntityIds.
/// \param IsFunRet true iff the created EPL is associated with the return type
/// of a function entity.
llvm::Expected<EntityPointerLevel>
creatEntityPointerLevel(const NamedDecl *ND,
llvm::function_ref<EntityId(EntityName EN)> AddEntity,
bool IsFunRet = false);

/// Creates a new EntityPointerLevel (EPL) from `E` by incrementing `E`'s
/// pointer level.
/// \return the EPL that is associated with the pointee (or array element) type
/// of `E`'s associated pointer/array tyoe of the same entity.
EntityPointerLevel incrementPointerLevel(const EntityPointerLevel &E);
} // namespace clang::ssaf

#endif // LLVM_CLANG_SCALABLESTATICANALYSISFRAMEWORK_ANALYSES_ENTITYPOINTERLEVEL_ENTITYPOINTERLEVEL_H
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
//===- EntityPointerLevelFormat.h -------------------------------*- C++-*-===//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//

#ifndef LLVM_CLANG_SCALABLESTATICANALYSISFRAMEWORK_ANALYSES_ENTITYPOINTERLEVEL_ENTITYPOINTERLEVELFORMAT_H
#define LLVM_CLANG_SCALABLESTATICANALYSISFRAMEWORK_ANALYSES_ENTITYPOINTERLEVEL_ENTITYPOINTERLEVELFORMAT_H

#include "clang/ScalableStaticAnalysisFramework/Analyses/EntityPointerLevel/EntityPointerLevel.h"
#include "clang/ScalableStaticAnalysisFramework/Core/Serialization/JSONFormat.h"

namespace clang::ssaf {
llvm::json::Value
entityPointerLevelToJSON(const EntityPointerLevel &EPL,
JSONFormat::EntityIdToJSONFn EntityId2JSON);

Expected<EntityPointerLevel>
entityPointerLevelFromJSON(const llvm::json::Value &EPLData,
JSONFormat::EntityIdFromJSONFn EntityIdFromJSON);
} // namespace clang::ssaf

#endif // LLVM_CLANG_SCALABLESTATICANALYSISFRAMEWORK_ANALYSES_ENTITYPOINTERLEVEL_ENTITYPOINTERLEVELFORMAT_H
Original file line number Diff line number Diff line change
Expand Up @@ -12,14 +12,10 @@
#include "clang/ScalableStaticAnalysisFramework/Analyses/EntityPointerLevel/EntityPointerLevel.h"
#include "clang/ScalableStaticAnalysisFramework/Core/Model/SummaryName.h"
#include "clang/ScalableStaticAnalysisFramework/Core/TUSummary/EntitySummary.h"
#include "llvm/ADT/StringRef.h"
#include "llvm/ADT/iterator_range.h"
#include <set>

namespace clang::ssaf {

/// An UnsafeBufferUsageEntitySummary is an immutable set of unsafe buffers, in
/// the form of EntityPointerLevel.
/// An UnsafeBufferUsageEntitySummary contains a set of EntityPointerLevels
/// extracted from unsafe buffer pointers contributed by an entity.
class UnsafeBufferUsageEntitySummary final : public EntitySummary {
const EntityPointerLevelSet UnsafeBuffers;

Expand Down

This file was deleted.

Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,11 @@ extern volatile int UnsafeBufferUsageSSAFJSONFormatAnchorSource;
[[maybe_unused]] static int UnsafeBufferUsageSSAFJSONFormatAnchorDestination =
UnsafeBufferUsageSSAFJSONFormatAnchorSource;

extern volatile int UnsafeBufferUsageTUSummaryExtractorAnchorSource;
[[maybe_unused]] static int
UnsafeBufferUsageTUSummaryExtractorAnchorDestination =
UnsafeBufferUsageTUSummaryExtractorAnchorSource;

// This anchor is used to force the linker to link the CallGraphExtractor.
extern volatile int CallGraphExtractorAnchorSource;
[[maybe_unused]] static int CallGraphExtractorAnchorDestination =
Expand Down
Loading
Loading